A Cross‑Site Request Forgery flaw in the Web Directory Free plugin allows an attacker to trick an authenticated or unauthenticated user into submitting a malicious request that stores injected script code. The stored script executes whenever a site visitor views the affected page, leading to stored XSS. This flaw is classified as CWE‑352.

The vulnerability impacts versions of the Web Directory Free plugin by Shamalli up to and including 1.7.6. Sites running any of these releases with the plugin enabled are susceptible. No other products are listed as affected.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of being exploited at this time. Because the issue is not yet in the CISA KEV catalog, there are no publicly known active exploits. The attack vector relies on CSRF, meaning an attacker can lure a user to a crafted link or embedded frame that submits the malicious payload. If successful, the attacker gains the ability to inject arbitrary client‑side code into the site, potentially defacing content or phishing for credentials.