The orlandolac Facilita Form Tracker product, up to version 1.0, is affected by a CSRF vulnerability that can lead to stored XSS attacks. This means an attacker could trick an authenticated user into submitting malicious requests that the application processes, resulting in persistent script injection. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow attackers to execute stored XSS via CSRF, potentially compromising user sessions, injecting malicious scripts, and impacting confidentiality, integrity, and availability at a low level. The overall impact is rated high due to the combination of CSRF and stored XSS, which can be leveraged for further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests. Additionally, applying input sanitization to prevent stored XSS may mitigate impact. Monitor vendor communications for updates on patches or official fixes.