The khubbaib Mandrill WP plugin contains a CSRF vulnerability in its email-form-under-post feature that enables stored XSS attacks. This issue affects all versions up to 1.0.5. The vulnerability allows an attacker to trick an authenticated user into submitting a forged request, which results in malicious scripts being stored and executed in the context of the affected site. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low level.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected website. This can result in information disclosure, modification of site content, or denial of service. The vulnerability impacts confidentiality, integrity, and availability, but at a low level for each. There are no known exploits in the wild at this time.

No patch or official fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or removing the affected plugin version to mitigate risk. Additionally, applying web application firewall (WAF) rules that block CSRF and XSS attempts may provide temporary protection.