The Annie plugin contains a CSRF vulnerability that can be abused to store malicious client‑side script in the site content. By forcing an authenticated user to submit a forged request, an attacker can create persistent XSS that runs in the browser of anyone who later views the affected page. The weakness is a classic lack of CSRF protection that results in stored cross‑site scripting, classified as CWE‑352.

This issue affects the Chris Roberts Annie WordPress plugin in all releases up to and including version 2.1.1. Site administrators who keep the plugin at these or earlier versions should be aware of the potential risk.

The CVSS score is 7.1, indicating a high severity. The EPSS score is below 1%, suggesting that, although high severity, the likelihood of exploitation at present is low. The vulnerability is not listed in the CISA KEV catalog. The attack requires the victim to be logged in or have a privileged role and to visit a crafted URL that forces the forged request, so an attacker with access to the user’s browser or the ability to embed the malicious link in emails or other content could exploit it. The attacker could leverage the CSRF to inject persistent JavaScript, compromising the confidentiality, integrity, or availability of the site for all users. Mitigation is most effectively achieved by patching.