A cross‑site request forgery flaw in the a2rocklobster FTP Sync plugin enables an attacker to execute JavaScript that will be stored in the plugin’s data and run in the browsers of all visitors to the WordPress site, allowing the attacker to steal session cookies, deface pages, or launch further attacks. The weakness is a classic CSRF bug (CWE‑352) that permits the injection of persistent scripts without any user interaction beyond visiting a crafted page in the context of an authenticated session.

The vulnerability affects the FTP Sync plugin from a2rocklobster, version 1.1.6 and earlier. All installations of the plugin that have not been updated past this point are susceptible. No other WordPress components are directly listed as affected by this flaw.

The CVSS score of 7.1 indicates moderate impact, but the EPSS score of less than 1% suggests low likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Inferred from the nature of CSRF, an attacker would need access to an authenticated session—typically an administrator’s credentials—to carry out the stored XSS payload. Once stored, the malicious script runs for all visitors, shifting the risk from a single privileged account to the entire user base. The lack of a high EPSS score mitigates urgency, yet the potential for wide impact and the possibility of credential compromise warrant timely remediation.