The Fancy Roller Scroller plugin by Thomas K Landis contains a CSRF vulnerability that enables stored XSS attacks. This affects all versions up to 1.4.0. The vulnerability allows attackers to trick authenticated users into submitting unauthorized requests, which can result in malicious scripts being stored and executed in the context of the affected application. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of users interacting with the affected plugin. This can compromise user data confidentiality, integrity, and availability. The vulnerability requires user interaction but no privileges, and it can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Fancy Roller Scroller plugin if feasible. Additionally, applying web application firewalls or CSRF protection mechanisms may help mitigate exploitation risk.