The LukaszWiecek Smart DoFollow plugin versions up to 1.0.2 contain a CSRF vulnerability that enables attackers to execute stored XSS attacks. This occurs because the plugin does not properly verify the origin of requests, allowing malicious requests to be executed with the privileges of an authenticated user. The vulnerability is network exploitable without privileges and requires user interaction. The impact includes partial confidentiality, integrity, and availability loss.

Successful exploitation of this vulnerability can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the affected application. This can result in data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. The CVSS score of 7.1 indicates a high severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patches or fixes have been referenced in the provided data. Until a patch is available, users should consider disabling the plugin or limiting its use to trusted environments to reduce exposure.