The what3words Address Field component up to version 4.0.15 contains a CSRF vulnerability that can be leveraged to inject stored XSS payloads. This means an attacker could trick an authenticated user into submitting a malicious request that stores executable script code within the application, potentially impacting confidentiality, integrity, and availability. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction, and the vulnerability affects confidentiality, integrity, and availability to a limited extent.

Successful exploitation could lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected application. This can result in data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high impact, but no known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and apply patches once available. Until then, consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate risk.