Cross‑Site Request Forgery in the Style Admin plugin allows an attacker to inject malicious JavaScript into stored data. By forging a request from a victim’s browser, the attacker can store user‑controlled scripts that will run in the context of any user who views the affected content, compromising confidentiality, integrity, and availability of the site.

WordPress sites running the FuzzGuard Style Admin plugin version 1.4.3 or earlier are affected. Any installation where the plugin is present and enabled is vulnerable until an upgrade or removal.

The vulnerability scores moderately high with a CVSS of 7.1. The EPSS score of less than 1% indicates a very low probability of exploitation currently, and the issue is not listed in the CISA KEV catalog. Based on the description, the attacker needs to cause a victim's browser to send a forged request, such as by clicking a crafted link or being redirected to a malicious page; it is inferred that authentication is not required, but the CVE data does not explicitly confirm this. Once the request executes, an attacker can store arbitrary JavaScript that will run for all users viewing the affected content.