The 'Inquiry Form to Posts or Pages' WordPress plugin version 1.0 is vulnerable to CSRF resulting in stored XSS due to missing nonce validation on the settings update handler and insufficient input sanitization and output escaping. The handler triggers on a POST parameter without verifying a WordPress nonce, allowing unauthenticated attackers to craft malicious requests that execute arbitrary scripts when an administrator visits a malicious page.

An attacker can exploit this vulnerability to inject and store malicious scripts in the plugin settings by tricking an administrator into submitting a forged request. This can lead to stored XSS, potentially allowing script execution in the context of the administrator's browser session. The CVSS score of 4.3 reflects a medium impact with low complexity and no required privileges but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid visiting untrusted or suspicious pages while logged into WordPress with administrative privileges. Monitoring for plugin updates from the vendor is recommended to apply an official fix once released.