The Sanjay_Negi Floating Video Player versions up to 1.0 contain a CSRF vulnerability that enables stored XSS attacks. This means that an attacker could trick a user into submitting unauthorized requests that result in malicious scripts being stored and executed within the application context. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS 3.1 vector indicates network attack vector, low complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation of this vulnerability could allow an attacker to execute stored malicious scripts in the context of the vulnerable application, potentially leading to unauthorized actions, data manipulation, or disruption of service. The impact affects confidentiality, integrity, and availability but at a low level for each. There are no known exploits in the wild at this time.

No official patch or remediation is currently available for this vulnerability. Users of the Floating Video Player should follow vendor advisories for updates. Until a fix is released, consider applying any available workarounds or limiting exposure by restricting access to the vulnerable component. Avoid user interactions that could trigger CSRF attacks where possible.