The GabbyKhrmon Wsify Widget version 1.0 and earlier contains a CSRF vulnerability that enables stored XSS attacks. This means an attacker can trick a user into submitting unauthorized requests that result in malicious scripts being stored and executed within the widget context. The vulnerability affects confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No vendor patch or fix information is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute stored malicious scripts via CSRF, potentially leading to partial disclosure of information, modification of data, and disruption of service. The impact affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate the risk. Monitor vendor channels for updates and apply patches promptly once available.