The etemplates ECT Add to Cart Button plugin (version <= 1.4) contains a CSRF vulnerability that enables attackers to execute unauthorized requests on behalf of authenticated users. This vulnerability can result in Stored XSS, potentially allowing attackers to inject malicious scripts that persist on the affected site. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to unauthorized actions performed by users without their consent, including the injection of persistent malicious scripts (Stored XSS). This can compromise user sessions, steal sensitive information, or perform actions with the victim's privileges. The overall impact is rated high due to the combination of CSRF and Stored XSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests. Additionally, monitoring for suspicious activity related to the Add to Cart functionality is advisable.