The akira1891 UPDATE NOTIFICATIONS plugin versions up to 0.3.4 contain a CSRF vulnerability that enables stored XSS attacks. This means an attacker could trick a user into submitting a request that the application trusts, resulting in malicious script storage and execution. The CVSS 3.1 score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute stored malicious scripts in the context of the affected application, potentially leading to data theft, session hijacking, or other malicious actions. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin to reduce risk. Implementing CSRF protections and input validation may help mitigate impact but are not confirmed as fixes for this issue.