This vulnerability in the WP Custom Post RSS Feed plugin allows an attacker to exploit a CSRF weakness to inject stored XSS payloads. The issue affects all versions up to 1.0.0. The CVSS vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability with a scope change.

Successful exploitation could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions on behalf of authenticated users, data disclosure, data modification, and partial service disruption. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the WP Custom Post RSS Feed plugin if feasible, or apply any recommended temporary mitigations from the vendor once published.