The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to inject arbitrary scripts into the website’s stored data. When an authenticated user submits a form under the attacker’s guidance, malicious JavaScript can be written into the site’s content, enabling persistent cross‑site scripting that can steal user credentials, modify page content, and deface the site.

The issue affects the WordPress Auto FTP plugin developed by Ciprian Turcu. All released versions through 1.0.1 are vulnerable; the wording "from n/a through <= 1.0.1" indicates that any install prior to or including 1.0.1 is at risk.

With a CVSS score of 7.1, the flaw is considered medium‑to‑high severity. The EPSS score of less than 1 % indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path relies on a CSRF vector, requiring the attacker to coerce an authenticated user, typically an administrator, into submitting a crafted request that stores malicious script code. Once stored, the script executes in the context of any visitor to the affected content, enabling theft of session cookies, defacement, and further lateral movement.