This vulnerability in the marcucci Password Protect Plugin for WordPress enables CSRF attacks that can result in stored XSS. It affects all versions up to 0.8.1.0. The CVSS 3.1 score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch link available at this time, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation can allow attackers to execute stored XSS via CSRF, potentially compromising user data confidentiality, integrity, and availability within affected WordPress sites using this plugin version. This can lead to session hijacking, defacement, or other malicious actions facilitated by the stored XSS payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor official marcucci or WordPress plugin repositories for updates addressing this vulnerability.