The Mahbubur Rahman Post Meta plugin versions up to 1.0.9 contain a CSRF vulnerability that can be exploited to trigger reflected XSS attacks. This vulnerability enables an attacker to craft malicious requests that, when executed by an authenticated user, can lead to unauthorized actions and injection of malicious scripts. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow attackers to perform actions with the privileges of an authenticated user and execute reflected XSS attacks, potentially leading to session hijacking, unauthorized changes, or other malicious activities. The impact on confidentiality, integrity, and availability is rated as low, but the overall severity is high due to the combination of factors in the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or limiting use of the affected plugin and apply standard CSRF mitigations such as verifying request origins and implementing anti-CSRF tokens where possible.