The addfreespace plugin for WordPress contains a CSRF vulnerability due to missing nonce validation. Attackers can forge a request to change plugin settings and inject malicious scripts that will persist in the site and execute in future visits. This flaw enables a remote attacker to perform cross‑site scripting at the site user level, compromising the integrity and confidentiality of the site content. The weakness corresponds to CWE‑352.

Vendors: kazunii addfreespace. Products: the addfreespace WordPress plugin, versions up to and including 0.1.3 are affected. No specific minor version gaps are listed beyond 0.1.3, so all releases of the plugin in that range are at risk.

The CVSS score of 4.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting exploitation is currently low probability but not impossible. Attackers would need to trick an administrator into visiting a crafted link to trigger the CSRF; once the settings are modified, the stored script will run for all users. Because the vulnerability relies on administrator interaction, it is not fully automated and requires social engineering.