This vulnerability in the Mark Barnes Style Tweaker plugin introduces a Cross‑Site Request Forgery weakness that permits a malicious actor to store arbitrary JavaScript in the plugin’s configuration. The stored code is later rendered on the site and executed in the browser context of any visitor. Because the flaw results in stored cross‑site scripting, the impact is limited to users who view affected pages; the attacker can potentially alter page content or exfiltrate sensitive data from victims’ browsers.

WordPress sites that install the Style Tweaker plugin from Mark Barnes through its earliest release up to version 0.11 are affected. This includes all releases prior to 0.12.

The CVSS score of 7.1 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests that the probability of exploitation is currently low. The likely attack vector is web‑based CSRF: an attacker must forge a request to the plugin’s configuration endpoint, a step that can be automated with standard CSRF techniques. Because the flaw allows for stored XSS, any visitor who loads the impacted pages will execute the injected script. The vulnerability is not currently listed in CISA’s KEV catalog, indicating that known exploits have not been reported in the wild.