This vulnerability (CVE-2024-22290) involves a CSRF flaw in the Custom Dashboard Widgets by AboZain,O7abeeb,UnitOne, which can be leveraged to execute Cross-Site Scripting (XSS) attacks. It affects versions up to 1.3.1. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction, and it impacts confidentiality, integrity, and availability to a limited extent. No vendor-provided patch or official remediation level is documented, and the product is not a cloud service.

Successful exploitation could allow attackers to trick authenticated users into executing unwanted actions, leading to Cross-Site Scripting. This can result in partial compromise of user data confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high severity impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests where possible. Monitoring for updates from the vendor is recommended.