This vulnerability affects John Godley Tidy Up versions up to 1.3 and involves a Cross-Site Request Forgery (CSRF) issue that enables an attacker to perform unauthorized actions on behalf of an authenticated user. Additionally, the vulnerability allows reflected Cross-Site Scripting (XSS), which could be leveraged to execute malicious scripts in the context of the victim's browser. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to trick a user into executing unwanted actions within the Tidy Up application, potentially leading to unauthorized changes or data exposure via reflected XSS. The scope change in the CVSS vector indicates that the vulnerability affects resources beyond the initially vulnerable component. However, no known exploits are currently reported in the wild.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should exercise caution with untrusted links and consider implementing additional CSRF protections or input validation where possible.