The Maeve Lander PayPal Responder product versions up to 1.2 contain a CSRF vulnerability that enables Stored XSS attacks. This vulnerability allows remote attackers to trick authenticated users into submitting unwanted requests, potentially resulting in the injection and storage of malicious scripts. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No official remediation or patch has been documented yet.

Successful exploitation of this vulnerability can lead to Stored XSS, which may allow attackers to execute malicious scripts in the context of the victim's browser session. This can compromise user data confidentiality, integrity, and availability. The vulnerability is exploitable remotely and requires user interaction, increasing the risk in environments where users are exposed to untrusted content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard CSRF mitigations such as implementing anti-CSRF tokens and validating request origins if possible. Monitoring for suspicious activity related to this component is advisable. Avoid interacting with untrusted links or content that could trigger CSRF attacks targeting this product.