Based on the description, it is inferred that an authentication‑based CSRF flaw allows an attacker with editing rights to send a forged request that contains arbitrary HTML. The plugin stores this HTML without sanitization, so malicious JavaScript becomes part of the persistent content. When any visitor views the affected page, the injected script runs in their browser, delivering stored cross‑site scripting. The weakness is classified as CWE‑352.

WordPress sites that have the FolioVision Foliopress WYSIWYG plugin installed at version 2.6.18 or earlier are affected. No other vendors or products are impacted, and installations lacking the plugin are not susceptible.

The CVSS score of 7.1 labels the vulnerability as high severity, while the EPSS score of less than 1% indicates a low likelihood of active exploitation at present. The flaw is not included in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires an authenticated user with editing privileges to submit a POST request that bypasses the missing CSRF token, embed malicious script, and store it in the content database. The resulting code executes for all visitors, magnifying the attack impact beyond the originating request.