The godthor Disqus Popular Posts plugin version 2.1.1 and earlier contains a CSRF vulnerability that enables an attacker to perform unauthorized actions on behalf of an authenticated user. Additionally, the vulnerability allows reflected XSS attacks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to trick a user into executing unwanted actions within the context of their authenticated session, potentially leading to reflected XSS attacks. This can result in limited disclosure of information, modification of data, and disruption of service. The overall impact is rated as high severity based on the CVSS score of 7.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, consider implementing CSRF protections such as verifying origin headers or using anti-CSRF tokens if possible within the application environment.