The karlkiesinger Country Blocker plugin versions up to 3.2 contain a CSRF vulnerability that enables attackers to inject stored XSS payloads. The vulnerability has a CVSS score of 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, but user interaction needed. The vulnerability impacts confidentiality, integrity, and availability at a low level. No patch or mitigation details are currently provided.

Successful exploitation of this vulnerability can lead to stored XSS attacks, which may allow attackers to execute arbitrary scripts in the context of affected users. This can compromise user data confidentiality and integrity and potentially affect availability. The attack requires user interaction and can be performed remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or limiting its use to trusted environments. Monitor vendor communications for updates on patches or official mitigations.