The Kelvin Ng Shortcode in Comment plugin versions up to 1.1.1 contain a CSRF vulnerability that enables stored XSS attacks. An attacker could trick an authenticated user into submitting a crafted request that stores malicious script code, which would then execute in the context of the affected application. This vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity due to network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute stored cross-site scripting attacks, potentially leading to unauthorized actions performed in the context of the victim user, data disclosure, or manipulation. The vulnerability impacts confidentiality, integrity, and availability to a limited degree as indicated by the CVSS vector. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor communications for updates regarding patches or official mitigations.