The stesvis Frontpage category filter plugin contains a CSRF flaw that allows an attacker to submit requests to the plugin’s functionalities without the victim’s consent. This vulnerability could enable unauthorized modification of the plugin’s behavior, potentially affecting data exposed by the plugin. The weakness is identified as CWE‑352.

Any WordPress site running the Frontpage category filter plugin version 1.0.2 or earlier is affected, as the vulnerability applies to all releases up to and including 1.0.2.

The CVSS score of 4.3 indicates moderate risk, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The CVE description does not detail specific attack conditions or prerequisites; it merely states the existence of a CSRF flaw. Typical CSRF attacks would require the victim to be authenticated and to visit a crafted URL, but this is not explicitly confirmed in the supplied data.