This vulnerability in the Sana Ullah Import Users to MailChimp plugin allows an attacker to exploit a CSRF flaw to trigger actions without user consent. Additionally, the plugin suffers from a Stored XSS vulnerability, which could be leveraged to execute malicious scripts in the context of the affected application. The CVSS score of 7.1 reflects the network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability with scope changed.

Successful exploitation could allow attackers to perform unauthorized actions on behalf of authenticated users via CSRF, and execute persistent malicious scripts through Stored XSS. This may lead to partial disclosure of information, modification of data, and disruption of service availability within the affected application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin to mitigate risk. Implementing CSRF protections and input sanitization may reduce exposure but rely on vendor updates for full remediation.