Cross‑Site Request Forgery vulnerability in Zita Elementor Site Library plugin allows attackers to execute actions on behalf of authenticated users. The flaw occurs because the plugin does not enforce proper CSRF protection for its endpoints. An attacker can craft a malicious request that triggers a state‑changing operation, such as updating content or changing settings, when a logged‑in user visits a malicious page. This undermines the integrity of the site and can lead to defacement or data tampering.

The vulnerability affects the wpzita Zita Elementor Site Library plugin – all versions up through 1.6.6 are susceptible. No earlier vulnerable version is specified, but any release prior to the patched version should be considered at risk until it is updated.

With a CVSS score of 4.3 the risk is moderate, and an EPSS score of less than 1% indicates a low probability of exploitation in the short term. The vulnerability is not listed in the CISA KEV catalog. The attack vector is via the web: an attacker must entice a logged‑in user to visit a malicious site that forces a state‑changing request to the plugin’s endpoint. No additional network access or privileged credentials are required beyond user authentication, but successful exploitation compromises the site’s integrity.