A Cross-Site Request Forgery vulnerability in the ShrinkTheWeb (STW) Website Previews plugin enables Stored XSS, potentially allowing attackers to execute unauthorized actions on behalf of administrators.

The vulnerability is a Cross-Site Request Forgery (CWE-352) that allows an unauthenticated attacker to trigger Stored Cross-Site Scripting. By tricking an authenticated user into performing an action, the attacker can inject malicious scripts into the application.

Successful exploitation of this vulnerability can lead to unauthorized script execution in the context of the victim's browser, potentially resulting in session hijacking, data theft, or unauthorized configuration changes. Given the CVSS score of 7.1, this represents a high-risk security flaw that could compromise the integrity and confidentiality of the WordPress environment.

Immediate Action: Currently, there is no disclosed patch version; users should monitor the vendor advisory for updates and consider disabling the plugin if it is not business critical.

Proactive Monitoring: Review web server access logs for anomalous requests or unexpected POST actions targeting the plugin configuration endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious CSRF patterns or cross-site scripting attempts directed at the WordPress site.

Public Exploit Available: No (exploit_available: false)

Due to the severity of stored XSS, administrators should treat this vulnerability with high priority. We recommend removing or deactivating the ShrinkTheWeb (STW) Website Previews plugin until a vendor-supplied update addressing this flaw is released and verified. Regularly audit plugin configurations to ensure that only trusted sources can perform administrative actions.