This vulnerability (CVE-2024-32549) in the Microkid Related Posts WordPress plugin allows an attacker to perform CSRF attacks that result in XSS. The affected versions include all up to 4.0.3. The CVSS 3.1 score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No patch or official fix has been published yet, and the vendor has not provided remediation details.

Successful exploitation could allow an attacker to execute unauthorized actions on behalf of an authenticated user via CSRF, leading to Cross-Site Scripting. This can compromise user data confidentiality, integrity, and availability within the affected WordPress environment. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin or applying any recommended temporary mitigations from trusted sources. Monitor official vendor channels for updates.