The vulnerability CVE-2024-53730 in springthistle April's Call Posts (<= 2.1.1) is a Cross-Site Request Forgery (CSRF) issue that enables stored XSS attacks. The CVSS 3.1 score is 7.1 (high), with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service. The vulnerability allows attackers to trick authenticated users into submitting malicious requests that result in stored XSS payloads.

Successful exploitation could allow attackers to execute stored cross-site scripting attacks via CSRF, potentially leading to limited compromise of user data, session hijacking, or disruption of service. The CVSS score indicates a high impact on confidentiality, integrity, and availability, but exploitation requires user interaction and no privileges are needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting use of the affected plugin and apply any recommended security controls to limit CSRF risks. Monitor official springthistle advisories for updates.