This vulnerability in David Garcia Domain Sharding (<= 1.2.1) allows an attacker to exploit a Cross-Site Request Forgery (CSRF) weakness to inject stored Cross-Site Scripting (XSS) payloads. The CVSS 3.1 score of 7.1 indicates a high impact with network attack vector, low attack complexity, no privileges required, but user interaction needed. The vulnerability affects confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits in the wild have been reported.

Successful exploitation can lead to stored XSS attacks, potentially allowing attackers to execute malicious scripts in the context of affected users, leading to data theft, session hijacking, or other malicious actions. The CSRF aspect enables attackers to trick authenticated users into submitting unauthorized requests. The impact affects confidentiality, integrity, and availability as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and input sanitization to mitigate stored XSS risks. Monitor official channels for updates from the vendor regarding patches or workarounds.