The ljmacphee Category of Posts plugin contains a CSRF vulnerability in the list-one-category-of-posts feature that enables stored XSS attacks. This means an attacker could trick a user into submitting a forged request that results in malicious script being stored and executed in the context of the vulnerable application. The vulnerability affects versions up to 1.0. The CVSS 3.1 base score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute stored malicious scripts in the context of the affected application, potentially leading to unauthorized actions performed on behalf of users, data disclosure, or disruption of service. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens and restricting user input where possible. Monitoring for updates from the vendor or security advisories is recommended.