The Unsafe Mimetypes plugin for WordPress contains a cross‑site request forgery (CSRF) flaw that permits an attacker to store arbitrary JavaScript code within the plugin’s data fields. Once stored, the malicious script is served to any visitor using the plugin, enabling session hijacking, credential theft, defacement, or other client‑side attacks. The weakness falls under CWE‑352, a type of CSRF that leads to stored XSS.

The issue affects the ldrumm "Unsafe Mimetypes" plugin for WordPress. All releases up to and including version 0.1.4 are vulnerable; later releases are not listed as affected.

With a CVSS score of 7.1 and an EPSS score of less than 1%, the vulnerability poses a moderate security risk but is considered unlikely to be widely exploited at present. It is not listed in the CISA KEV catalog. The likely attack vector involves an attacker directing a victim to a crafted, authenticated request that exploits the CSRF flaw to inject malicious payloads, which are then persisted and served to users.