This vulnerability in go Social (<= 1.0) involves CSRF that enables stored XSS attacks. An attacker can trick an authenticated user into submitting a forged request, which the application processes without proper validation. The stored XSS can then be used to execute malicious scripts in the context of the victim's browser session. The CVSS score of 7.1 indicates a high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized actions performed by authenticated users without their consent, resulting in stored XSS that compromises user data confidentiality, integrity, and availability. This can facilitate further attacks such as session hijacking or defacement within the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard CSRF mitigations such as implementing anti-CSRF tokens and validating the origin of requests. Avoid clicking on suspicious links while authenticated in the application.