This vulnerability involves a CSRF flaw in the LionScripts: Site Maintenance & Noindex Nofollow Plugin (versions up to 2.1) that can be leveraged to inject stored XSS payloads. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation could allow an attacker to execute stored XSS attacks by tricking an authenticated user into performing unintended actions. This may lead to partial compromise of user data confidentiality, integrity, and availability within the affected plugin's context. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting its use to trusted environments. Implementing anti-CSRF tokens and validating user requests can help mitigate the risk.