This vulnerability in Subscription DNA (up to version 2.1) involves a CSRF flaw that enables stored XSS attacks. An attacker could trick an authenticated user into executing unwanted actions, which may result in malicious scripts being stored and executed within the application context. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation could allow attackers to execute stored XSS attacks via CSRF, potentially compromising user sessions, data confidentiality, and application integrity. The vulnerability affects confidentiality, integrity, and availability at a low to moderate level as indicated by the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests to mitigate risk. Monitoring vendor communications for updates is recommended.