TI-2025-29213 CVE-2025-46495 · GHSA-wh2h-f35v-32p8WordPress Drop Caps plugin <= 2.1 - CSRF to XSS vulnerabilityPriority LOW 28Cross-Site Request Forgery (CSRF) vulnerability in tomontoast Drop Caps drop-caps allows Stored XSS.This issue affects Drop Caps: from n/a through <= 2.1.CVSS 3.1MEDIUM 6.5· Network · Low privileges · User interaction · EPSS 0.00144 · Published 2025-04-24 · No fix listed CWE-352