This vulnerability in the dkukral Email on Publish plugin allows an attacker to exploit a CSRF flaw that leads to stored XSS. The affected versions are from initial releases through 1.5. The CVSS vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The impact includes partial confidentiality, integrity, and availability loss. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker to execute stored cross-site scripting attacks via CSRF, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 7.1 reflects a high severity impact, but no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing CSRF protections and input sanitization as temporary mitigations if possible.