The ShayanWeb Admin FontChanger plugin contains a Cross‑Site Request Forgery flaw that permits an attacker to inject malicious JavaScript into the site’s database. Exploiting this flaw leads to stored cross‑site scripting, where any user viewing the compromised site becomes subject to the attacker’s payload. The vulnerability is classified as CWE‑352, indicating that the lack of a valid anti‑CSRF token allows the attacker to perform unauthorized actions on behalf of legitimate users.

The flaw exists in ShayanFarhang Pazhooh’s ShayanWeb Admin FontChanger plugin for WordPress, affecting all releases from the initial version through 1.9.1. Any WordPress installation that has not updated beyond 1.9.1 and has the plugin enabled is impacted.

The CVSS base score is 7.1, signalling a high severity. The EPSS score is below 1 %, so the likelihood of widespread exploitation is low at present. The vulnerability is not listed in the CISA KEV catalogue. Nevertheless, attackers can trigger the CSRF by enticing users to visit a crafted link or embed malicious content that forces the victim’s browser to perform privileged requests without their knowledge. Once the malicious script is stored, every page visitor can execute the code, leading to data theft or session hijacking.