The WP Flipkart Importer plugin for WordPress, developed by Shambhu Patnaik, contains a CSRF vulnerability that enables stored XSS attacks. The vulnerability affects all versions up to 1.4. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected WordPress site through unauthorized requests and persistent script injection.

Successful exploitation of this vulnerability can allow attackers to execute stored cross-site scripting attacks via CSRF, potentially leading to unauthorized actions on the affected WordPress site. This impacts the confidentiality, integrity, and availability of the site, as indicated by the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP Flipkart Importer plugin if it is not essential. Additionally, applying general CSRF mitigations such as enforcing nonce verification in WordPress plugins may reduce risk, but specific vendor guidance should be followed once available.