The Flytedesk Digital plugin for WordPress is vulnerable to a CSRF-based Stored XSS attack, which could allow an unauthenticated attacker to execute malicious scripts in the context of an administrator.

This vulnerability is a Cross-Site Request Forgery (CWE-352) that enables an unauthenticated attacker to inject malicious scripts into the application. By tricking an authenticated user into performing an action, the attacker can achieve Stored XSS, potentially compromising the user session or site integrity.

The successful exploitation of this vulnerability poses a significant risk to the integrity and confidentiality of the WordPress environment. With a CVSS score of 7.1, it is categorized as High severity, as it allows attackers to execute arbitrary code in the browser of an unsuspecting administrator. This could lead to account takeover, unauthorized data modification, or the redirection of site traffic to malicious domains.

Immediate Action: Since a specific patch is currently unknown, administrators should immediately deactivate and remove the Flytedesk Digital plugin from their WordPress environments until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting plugin-specific endpoints, particularly those originating from unexpected referrers.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common CSRF and XSS patterns, which may provide temporary protection while the plugin remains inactive.

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available in the provided data.

Due to the severity of stored XSS vulnerabilities, it is imperative that organizations prioritize the removal of the vulnerable Flytedesk Digital plugin. Until the vendor provides a verified security update, complete removal is the only effective method to eliminate the risk of exploitation.