This vulnerability in Elevio by Dixa Elevio allows an attacker to exploit CSRF to cause stored XSS. It affects Elevio versions up to 4.4.1. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no privileges, but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability at a low level. No patch or official remediation information is currently provided.

Successful exploitation could allow an attacker to execute unauthorized actions on behalf of an authenticated user via CSRF, potentially leading to stored XSS attacks. This could result in limited compromise of confidentiality, integrity, and availability of the affected system. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as anti-CSRF tokens and validating user requests to mitigate risk. Monitor vendor communications for updates on patches or official mitigations.