CVE-2026-9731 is a CSRF vulnerability in the Wp Js Detect plugin for WordPress affecting all versions up to 1.0.9. The root cause is the lack of proper nonce validation in the plugin_settings function, which permits attackers to perform unauthorized updates to the plugin's notification text and CSS settings. These settings are then reflected unescaped on the frontend, enabling content injection through a forged request that requires user interaction (administrator clicking a link). The CVSS 3.1 base score is 4.3, indicating a medium severity vulnerability with network attack vector, low attack complexity, no privileges required, but requiring user interaction and impacting integrity only.

An attacker can exploit this vulnerability to inject arbitrary content into the notification text and CSS settings of the plugin by tricking a site administrator into performing an action such as clicking a malicious link. This could lead to content injection on the frontend, potentially affecting the integrity of the site’s displayed content. There is no direct impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and monitor for suspicious changes to plugin notification text and CSS settings. Implementing manual nonce validation or disabling the plugin temporarily may reduce risk.