This vulnerability in Prayer Times Anywhere (<= 2.0.1) allows an attacker to exploit CSRF to cause stored XSS, which can lead to client-side code execution in the context of the victim's browser. The vulnerability requires user interaction (UI:R) and can be exploited remotely (AV:N) without privileges (PR:N). The impact includes partial confidentiality, integrity, and availability loss (C:L/I:L/A:L). No official patch or vendor advisory is currently available.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the victim's browser via stored XSS triggered through CSRF. This can lead to unauthorized actions performed as the victim user, potentially compromising user data and application integrity. The vulnerability affects confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests. Additionally, applying input sanitization to prevent stored XSS may reduce risk. Monitor vendor channels for updates.