The 'Inquiry Form to Posts or Pages' WordPress plugin version 1.0 suffers from a CSRF vulnerability due to missing nonce validation on its settings update handler. This handler triggers when $_POST['inq_hidden'] == 'Y' without verifying a WordPress nonce or calling check_admin_referer(). Additionally, all user-supplied fields lack proper input sanitization and output escaping, leading to stored XSS. An attacker can exploit this by crafting a forged request that causes a logged-in administrator to unknowingly inject arbitrary scripts into the plugin's stored settings, which are then rendered without escaping.

Successful exploitation allows an unauthenticated attacker to perform CSRF attacks that result in stored XSS within the plugin's settings. This can lead to arbitrary script execution in the context of an administrator's browser session, potentially enabling actions such as session hijacking or unauthorized administrative actions. However, the CVSS score of 4.3 indicates a medium impact with no direct confidentiality or availability loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid visiting untrusted sites while logged into WordPress with administrative privileges and consider disabling or removing the vulnerable plugin to prevent exploitation.