The ElbowRobo Read More Copy Link plugin, version 1.0.2 and earlier, contains a CSRF vulnerability that enables stored XSS attacks. This means an attacker can trick an authenticated user into submitting a request that results in malicious script storage, potentially impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and a scope change with low confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This can compromise user data confidentiality, integrity, and availability to a limited extent. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable plugin or restricting access to trusted users only. Implementing anti-CSRF tokens and input sanitization may help mitigate the risk, but these require vendor or user-side changes.