The blueskyy WP-Ban-User plugin suffers from a CSRF vulnerability that enables stored XSS attacks. This affects all versions up to 1.0. An attacker can trick an authenticated user into submitting a crafted request that leads to malicious script storage, potentially impacting confidentiality, integrity, and availability of the affected system. The vulnerability is remotely exploitable without privileges but requires user interaction. No vendor advisory or patch links are currently available, and the plugin is not a cloud service.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected site. This can compromise user data confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high severity with potential significant impact on affected systems. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the WP-Ban-User plugin or restricting its usage to trusted administrators only. Applying standard CSRF protections or using security plugins that detect and block CSRF attempts may provide temporary mitigation.