The Fonts Plugin Fonts contains a CSRF vulnerability (CWE-352) that enables an attacker to execute stored XSS attacks by tricking authenticated users into submitting unauthorized requests. This affects all versions up to 3.7.7. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute malicious scripts in the context of the victim's browser. This can result in data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity due to these potential impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Until a patch is available, users should be cautious with the Fonts Plugin Fonts and consider disabling or restricting its use to mitigate risk.