This vulnerability in Marco Castelluccio Web Push (<= 1.4.0) involves Cross-Site Request Forgery (CSRF) that can lead to stored Cross-Site Scripting (XSS). An attacker could exploit this by tricking an authenticated user into submitting a forged request, resulting in malicious script storage and execution. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no privileges, but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability at a low level.

Successful exploitation could allow attackers to execute stored XSS attacks via CSRF, potentially compromising user sessions, stealing data, or performing unauthorized actions within the affected Web Push application. The impact affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate risk. Monitor vendor channels for updates.