CVE-2026-9731 describes a CSRF vulnerability in the Wp Js Detect WordPress plugin affecting all versions up to 1.0.9. The root cause is missing or incorrect nonce validation on the plugin_settings function, which handles updates to notification text and CSS settings. An attacker can exploit this by tricking an authenticated site administrator into submitting a forged request, allowing the attacker to inject arbitrary content into these settings. This content is then rendered unescaped on the frontend, which may lead to content injection issues. There is no vendor advisory or patch currently available for this vulnerability.

An attacker can perform unauthorized updates to the plugin's notification text and CSS settings by exploiting the CSRF vulnerability, potentially injecting arbitrary content that is displayed unescaped on the frontend. This could lead to content injection, which may affect site integrity or user trust. However, the vulnerability does not directly impact confidentiality or availability. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and no privileges required but requiring user interaction.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, site administrators should be cautious about clicking on untrusted links while logged into WordPress admin interfaces to avoid CSRF exploitation. Implementing additional CSRF protections such as web application firewalls or custom nonce validation may help reduce risk until an official fix is released.