The ragaskar Amazon Associate Filter plugin versions up to 0.4 contain a CSRF vulnerability that enables stored XSS attacks. This issue allows attackers to trick authenticated users into executing unwanted actions, which can result in injection of malicious scripts stored within the application. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting its network accessibility, low attack complexity, requirement for user interaction, and impact on confidentiality, integrity, and availability at a low to partial level. No vendor advisory or patch links are provided, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of affected users. This can compromise user data confidentiality and integrity, and potentially disrupt availability. The CSRF aspect means attackers can induce authenticated users to perform unintended actions without their consent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version and apply standard CSRF and XSS protections where possible. Monitor vendor channels for updates and patches.