The CRUDLab Google Plus Button plugin versions up to 1.0.2 contain a CSRF vulnerability that enables stored XSS attacks. This occurs when an attacker tricks an authenticated user into submitting a crafted request that the application processes without proper verification, resulting in malicious script storage. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS score of 7.1 reflects the high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the victim's browser. This can result in data theft, session hijacking, or other malicious actions. The vulnerability affects the confidentiality, integrity, and availability of the affected system. No evidence of active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the CRUDLab Google Plus Button plugin to prevent exploitation. Implementing standard CSRF protections and input sanitization may reduce risk but are not confirmed mitigations for this specific issue.