The WPFactory WP Currency Exchange Rates plugin version 1.2.0 and earlier contains a CSRF vulnerability that enables stored XSS attacks. This vulnerability allows an attacker to trick an authenticated user into submitting a forged request, which results in malicious scripts being stored and executed within the application context. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the affected site. This can result in the compromise of user sessions, defacement, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability requires user interaction but no privileges, making it a significant risk for sites using the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP Currency Exchange Rates plugin if feasible. Additionally, applying web application firewall (WAF) rules that block CSRF and XSS attempts may provide temporary mitigation.