This vulnerability involves a CSRF flaw in the Micha I Plant A Tree product (versions <= 1.7.3) that enables an attacker to inject stored XSS payloads. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited extent. The vulnerability is publicly disclosed but lacks an official patch or mitigation guidance from the vendor at this time.

Successful exploitation could allow attackers to execute stored XSS attacks by tricking authenticated users into submitting unauthorized requests. This can lead to limited compromise of user data confidentiality, integrity, and availability within the affected application. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate the risk of stored XSS. Monitor official Micha communications for updates.