A Cross‑Site Request Forgery vulnerability in the Drop Caps plugin allows an attacker to store malicious JavaScript code that is executed when any user visits pages with the injected content. The weakness, identified as CWE‑352, means that an attacker with the ability to craft a request can exploit the plugin’s lack of proper CSRF protection to write arbitrary payloads into stored data.

The issue affects the tomontoast Drop Caps WordPress plugin for versions up to and including 2.1. All earlier releases are also vulnerable as the affected range is stated as "from n/a through <= 2.1".

The CVSS score of 6.5 indicates a moderate severity and an EPSS score of < 1% suggests the probability of exploitation is currently low, though not zero. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires an authenticated session that can submit plugin data, implying the attack would most likely originate from a malicious user account or through a session hijack that performs a CSRF POST request. The risk remains moderate due to the limited scope of compromised users and the need for valid credentials.