The Kiotviet KiotViet Sync plugin contains a CSRF vulnerability that permits attackers to inject malicious script into the plugin’s stored data. When an authenticated WordPress user submits a crafted request—without a proper anti‑CSRF check—the plugin blindly records the supplied payload as part of a comment, title, or other stored content. Subsequent visits to pages that display the stored data execute the attacker’s script in the context of every site visitor, exposing the site to session hijacking, credential theft, or other code‑execution risks.

All WordPress installations using Kiotviet KiotViet Sync version 1.8.4 or earlier are affected. The flaw is present in every release from the initial (non‑specified) version up to and including 1.8.4. No operating‑system, PHP, or WordPress version constraints are listed; the vulnerability resides solely in the plugin code.

With a CVSS score of 7.1 the risk is considered high, yet the EPSS score of less than 1% indicates that active exploitation is currently rare. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be web‑based, relying on an authenticated user’s browser session and a malformed request that the plugin accepts without a nonce or other CSRF countermeasure. The potential impact includes loss of confidentiality, integrity, and availability for all visitors to the affected site.