The Jesse Overright Social Media Sharing plugin versions up to 1.1 suffer from a CSRF vulnerability that enables stored XSS attacks. This means an attacker can trick a logged-in user into submitting a forged request that results in malicious script storage, which can then execute in the context of other users. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to session hijacking, defacement, or other malicious actions within the context of affected users. The impact affects confidentiality, integrity, and availability at a low level but combined with CSRF, it poses a significant risk to user trust and application security.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider implementing additional CSRF protections at the application or web server level, such as verifying origin headers or using web application firewalls to block suspicious requests. Avoid user interactions that could trigger the vulnerability and restrict access to trusted users where possible.