The Essential Marketer Essential Breadcrumbs plugin versions up to 1.1.1 contain a CSRF vulnerability that enables stored XSS attacks. This occurs because the plugin does not adequately verify the origin of requests, allowing attackers to trick authenticated users into executing malicious actions that result in stored script injection. The CVSS 3.1 base score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow attackers to execute stored cross-site scripting attacks via CSRF, potentially leading to unauthorized actions performed with the privileges of the victim user. This could compromise user data confidentiality, integrity, and availability within the affected application context.

No official patch or remediation guidance is currently available. Users should monitor the vendor's advisories for updates. Until a fix is released, consider disabling or restricting access to the Essential Breadcrumbs plugin to trusted users only and avoid clicking on untrusted links while authenticated. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.