The vulnerability is a Cross‑Site Request Forgery (CSRF) flaw that enables an attacker to inject and store malicious script code in the WordPress site. When the plugin processes a crafted request, the script is persisted and executed on subsequent page loads for all visitors, exposing sessions, credentials, and site integrity. This stored XSS can lead to session hijacking, defacement, or theft of sensitive data.

The affected product is the Flytedesk Digital plugin for WordPress, installed in all releases from the first available version up to and including the 20181101 release. All WordPress sites that have this plugin deployed and have not upgraded beyond that date are at risk, regardless of the underlying WordPress core version.

The CVSS score of 7.1 classifies the weakness as high severity. The EPSS score of less than 1% indicates that, as of the current assessment, exploitation is unlikely but not impossible. Because the issue is not listed in CISA’s KEV catalog, there is no known public exploit, but operators should treat the risk as significant because a successful CSRF payload can be delivered to any logged‑in administrator, potentially allowing arbitrary script execution within the target site.