The Dan Cameron Add RSS plugin versions up to 1.5 contain a CSRF vulnerability that enables stored XSS attacks. An attacker can trick an authenticated user into submitting a crafted request that results in malicious script storage within the application. This vulnerability has a CVSS 3.1 base score of 7.1, reflecting its high severity due to network accessibility, low complexity, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and the vulnerability is not related to a cloud service.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected application. This can compromise user data confidentiality, integrity, and availability. The vulnerability requires user interaction but no privileges, making it a significant risk for users of the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Add RSS plugin if feasible. Additionally, applying web application firewall (WAF) rules to detect and block CSRF and XSS attempts may help mitigate risk.