The nagarjunsonti My Login Logout Plugin version 2.4 and earlier contains a CSRF vulnerability that enables stored XSS attacks. This means an attacker can trick an authenticated user into submitting a crafted request that results in malicious script storage, which can then be executed in the context of the victim's browser. The vulnerability is network exploitable without privileges but requires user interaction. The CVSS vector indicates low attack complexity, no privileges required, user interaction needed, and impacts confidentiality, integrity, and availability at a low to high level.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of affected users, potentially compromising user data and session integrity. The CSRF aspect means attackers can induce victims to perform unwanted actions without their consent. The combined impact affects confidentiality, integrity, and availability to varying degrees as indicated by the CVSS score.

No patch or official fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or limiting use of the affected plugin version and apply standard CSRF mitigations if possible, such as implementing anti-CSRF tokens or restricting actions to verified users. Monitor vendor channels for updates.