The callmeforsox Post Thumbs plugin versions up to 1.5 contain a CSRF vulnerability that enables attackers to inject stored XSS payloads. This occurs because the plugin does not properly validate or protect against unauthorized cross-site requests, allowing malicious actors to execute scripts in the context of authenticated users. The vulnerability is remotely exploitable without privileges but requires user interaction (UI:R).

Successful exploitation can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of users interacting with the affected application. This can result in information disclosure, session hijacking, or other client-side impacts. The vulnerability also affects availability and integrity to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as tokens or disabling the vulnerable functionality if possible. Monitor vendor communications for updates on patches or official mitigations.