The vulnerability CVE-2024-53716 affects the 'wp auto top' WordPress plugin (versions <= 2.9.3) and is characterized by a Cross-Site Request Forgery (CSRF) flaw that enables Stored Cross-Site Scripting (XSS). This means an attacker can trick an authenticated user into submitting a forged request that results in malicious script storage, potentially compromising user sessions or site integrity. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to Stored XSS via CSRF, allowing attackers to execute malicious scripts in the context of the affected site. This can result in partial compromise of confidentiality, integrity, and availability of the affected WordPress installation or its users. The vulnerability does not require privileges but does require user interaction, and the scope of impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, users should consider disabling or removing the affected plugin or applying any recommended temporary mitigations from the vendor. Monitor official overtrue or WordPress security advisories for updates.