A Cross‑Site Request Forgery flaw exists in WordPress Style Manager plugin versions up to 2.2.7. The vulnerability permits an attacker to forge a request that changes plugin configuration settings while a victim is authenticated. This may allow the attacker to alter styling, redirect traffic, or enable further exploitation of the site.

The affected product is the Style Manager plugin released by pixelgrade. All releases through version 2.2.7, inclusive, are vulnerable. Earlier releases are also affected up to the stated version boundary.

The CVSS score of 4.3 indicates a low‐medium severity, and the EPSS score of <1% points to a very small chance that the flaw will be actively exploited. The attack requires an authenticated user and a crafted request; no public exploit has been reported, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, an unauthenticated attacker can target a logged‑in user to alter settings, posing a threat to site integrity.