The hosting.io WP Controller plugin for WordPress versions up to 3.2.0 contains a CSRF vulnerability that enables stored XSS attacks. An attacker can exploit this by tricking an authenticated user into submitting a crafted request, resulting in malicious script storage within the application. This vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the victim's browser. This can compromise user confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction but no privileges, and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with this plugin and consider disabling or restricting access to it to mitigate risk. Monitor for vendor updates regarding patches or official mitigations.