The acbaltaci Google Plus Share and +1 Button plugin suffers from a CSRF vulnerability that enables stored XSS attacks. This affects all versions up to 1.0. The vulnerability allows remote attackers to trick authenticated users into submitting unauthorized requests, which can result in malicious scripts being stored and executed in the context of the affected site. The CVSS 3.1 score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the vulnerable site, potentially compromising user data and site integrity. The CSRF aspect means attackers can induce authenticated users to perform unwanted actions without their consent. The combined impact affects confidentiality, integrity, and availability of the affected application.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or removing the affected plugin to prevent exploitation. Implementing standard CSRF protections and input sanitization may help mitigate risk but are not confirmed as effective without vendor guidance.