This vulnerability in mgplugin Roi Calculator (<= 1.0) involves a CSRF flaw that enables stored XSS attacks. An attacker can trick a user into submitting unauthorized requests that result in malicious scripts being stored and executed within the application context. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to stored XSS, allowing attackers to execute malicious scripts in the context of affected users. This compromises confidentiality, integrity, and availability of the affected system or user data to a limited extent. The vulnerability does not require privileges but does require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply general CSRF mitigations such as disabling or restricting the plugin, limiting user permissions, or employing web application firewalls that can detect and block CSRF and XSS attempts. Monitor vendor channels for updates.