This vulnerability in Woopy Plugins SmartLink Dynamic URLs (<= 1.1.0) involves a CSRF flaw that enables an attacker to cause stored XSS by tricking an authenticated user into submitting a crafted request. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation can result in stored XSS, which may allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability affects confidentiality, integrity, and availability at a low level but is considered high severity due to the combination of CSRF and stored XSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting the use of the affected plugin and applying any recommended temporary mitigations from the vendor. Monitor official Woopy Plugins channels for updates.