Cross‑Site Request Forgery (CSRF) allows an attacker to inject malicious script that is stored in the Rich Text Editor plugin’s content. The injected code is then executed whenever the affected content is viewed, enabling attackers to hijack sessions, steal credentials, or spread malware. The vulnerability is a direct exploitation of CSRF, as described by CWE‑352, and results in a stored cross‑site scripting attack that can compromise user accounts and the integrity of the site.

The Rich Text Editor WordPress plugin, version 1.0.1 and earlier, is affected. Vulnerable versions include all released builds through <=1.0.1. Site owners who have installed any of these versions are at risk until the plugin is updated.

The CVSS score of 7.1 indicates a high severity level, while the EPSS score of less than 1% shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a malicious website that tricks a user into submitting a form that triggers the CSRF mechanism, thereby storing malicious script on the site.