The isnowfy my-related-posts plugin versions up to 1.1 contain a CSRF vulnerability that enables stored XSS attacks. This vulnerability allows attackers to trick authenticated users into submitting unauthorized requests, which can result in malicious scripts being stored and executed in the context of the affected application. The CVSS 3.1 base score of 7.1 reflects the network-based attack vector, low complexity, no privileges required, but requiring user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of users interacting with the vulnerable plugin. This can compromise user data confidentiality, integrity, and availability of the affected system. The vulnerability does not require privileges but does require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected plugin or applying any available temporary mitigations recommended by the vendor. Avoid interacting with untrusted content or links that could trigger CSRF attacks related to this plugin.