A CSRF-to-XSS vulnerability in the Wolfgang Häfelinger Custom Style plugin for WordPress poses a risk of unauthorized script execution and potential account compromise.

This vulnerability is a Cross-Site Request Forgery (CWE-352) flaw that enables an unauthenticated attacker to inject malicious scripts into the application, resulting in Stored Cross-Site Scripting. The attack requires user interaction, such as a logged-in administrator clicking a malicious link, to trigger the payload.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of an administrator's browser session. This can lead to unauthorized changes to website content, administrative account takeover, or the exfiltration of sensitive user data. Given the CVSS score of 7.1, this is classified as a High severity issue requiring prompt attention to prevent site-wide compromise.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate and remove the Custom Style plugin from their WordPress environments until a secure update is provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests to administrative endpoints and monitor for unauthorized changes to plugin settings or injected script tags within site content.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common CSRF and XSS patterns, providing a layer of protection while the plugin remains unpatched.

Public Exploit Available: Unknown.

The risk associated with this vulnerability is elevated due to the potential for Stored XSS, which can lead to complete site takeover. We strongly recommend that organizations prioritize the removal of this plugin from their production environments immediately and maintain this posture until the vendor releases a verified security update that addresses the underlying CSRF flaw.