This vulnerability in Ninos FlashCounter (<= 1.1.8) allows an attacker to exploit CSRF to inject stored XSS payloads. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability at a low level. No patch or vendor advisory is currently provided, and no known exploits exist in the wild.

Successful exploitation could allow an attacker to execute stored XSS via CSRF, potentially leading to session hijacking, unauthorized actions, or other client-side impacts. The CVSS score of 7.1 reflects a high severity due to the combination of remote attack vector and the ability to affect multiple security properties. However, no active exploitation is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate the risk of stored XSS via CSRF. Monitor vendor channels for updates.