The vulnerability CVE-2024-54391 exists in the mattwalters WordPress Filter plugin (<= 1.4.1) and is classified as a Cross-Site Request Forgery (CSRF) that enables stored XSS attacks. An attacker can exploit this flaw by tricking an authenticated user into submitting a crafted request, which results in malicious script storage within the plugin's context. The CVSS 3.1 vector indicates the attack can be performed remotely with low attack complexity, no privileges required, but user interaction is necessary. The impact includes partial confidentiality, integrity, and availability loss.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected site. This can compromise user sessions, deface content, or perform actions on behalf of authenticated users. The CVSS score of 7.1 reflects a high severity impact with potential confidentiality, integrity, and availability consequences. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin or implementing additional CSRF protections at the application or web server level to mitigate risk.