ShayanWeb Admin FontChanger versions up to 1.9.1 contain a CSRF vulnerability that enables stored XSS attacks. This occurs because the plugin does not properly validate or protect against unauthorized cross-site requests, allowing attackers to inject malicious scripts that persist in the application. The vulnerability has a CVSS 3.1 base score of 7.1, with attack vector network, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or official fix information is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user-applied mitigations.

Successful exploitation of this vulnerability can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the affected application, potentially compromising user data, session tokens, or performing unauthorized actions. The CSRF aspect means attackers can trick authenticated users into submitting malicious requests. The combined impact affects confidentiality, integrity, and availability as indicated by the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens in requests and restricting administrative access. Avoid interacting with untrusted links or sites while authenticated to the affected application. Monitor vendor channels for updates or patches addressing this vulnerability.