The starise Twitter Shortcode plugin versions up to 0.9 contain a CSRF vulnerability that can be exploited to inject stored XSS payloads. This vulnerability enables attackers to trick authenticated users into executing unwanted actions, which may result in persistent cross-site scripting attacks. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow attackers to execute stored XSS attacks via CSRF, potentially compromising user data confidentiality, integrity, and availability within the affected application context. This could lead to unauthorized actions performed with the privileges of the targeted user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official starise communications for updates on patches or mitigations.