Cross‑Site Request Forgery allows an attacker to submit a request that stores malicious script into the ePaper Lister for Yumpu plugin’s storage mechanism. The stored payload can later be rendered to any visitor of the site, leading to hijacked sessions, data theft, or defacement. This is a classic example of an injection flaw classified as CWE‑352.

All installations of Lemmentwickler ePaper Lister for Yumpu with a version of 1.4.0 or earlier are vulnerable. Plugins lacking a version number are also potentially affected, as no higher version is specified as safe.

The CVSS score of 7.1 indicates a medium‑high severity vulnerability, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, but it remains a valid attack surface. Attackers can exploit it by tricking an authenticated user into visiting a crafted link that triggers the CSRF action, which then stores the malicious script for later execution by site visitors.