The daxiawp DX-auto-publish plugin versions up to 1.2 are affected by a CSRF vulnerability that enables stored XSS attacks. This means an attacker can trick an authenticated user into submitting a request that stores malicious script code, which can then be executed in the context of the victim's browser. The CVSS 3.1 base score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute stored malicious scripts in the context of an authenticated user, potentially leading to session hijacking, data theft, or other malicious actions. The vulnerability affects confidentiality, integrity, and availability to a limited extent. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the DX-auto-publish plugin or implementing additional CSRF protections at the application or web server level. Monitor official vendor channels for updates.