This vulnerability involves a CSRF flaw in the Custom Links On Admin Dashboard Toolbar plugin by Victor Barkalov, which allows an attacker to exploit the plugin's customization features on the WordPress admin dashboard. Successful exploitation can result in stored XSS, potentially enabling attackers to execute malicious scripts in the context of an authenticated admin user. The affected versions include all versions up to 3.3. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network exploitability, low complexity, no required privileges, but requiring user interaction and impacting confidentiality, integrity, and availability.

An attacker can exploit this vulnerability to perform unauthorized actions via CSRF that lead to stored XSS on the admin dashboard. This can compromise the confidentiality, integrity, and availability of the affected WordPress site by executing malicious scripts with admin privileges. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should consider disabling or removing the affected plugin to mitigate risk. Applying standard CSRF protections and limiting admin dashboard access may reduce exposure but are not direct fixes for this vulnerability.