The Juan Camilo Advanced PDF Generator plugin versions up to 0.4.0 are affected by a CSRF vulnerability that enables stored XSS attacks. This means that an attacker can trick an authenticated user into submitting a forged request that results in malicious script being stored and executed within the application context. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction, and it impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected application. This can compromise user data confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.1, indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens and validating request origins. Avoid exposing the affected plugin to untrusted users or environments where CSRF attacks could be initiated.