The frucomerci List of Posts from each Category WordPress plugin contains a CSRF vulnerability that enables an attacker to inject stored XSS payloads. This affects all versions up to 2.0. The vulnerability allows an attacker to trick an authenticated user into submitting a forged request, which results in persistent XSS being stored and potentially executed in the context of the victim's browser session. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low to low level.

Successful exploitation can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions. The CSRF aspect means that an attacker can induce authenticated users to perform unwanted actions without their consent. The overall impact affects confidentiality, integrity, and availability at a low level but is considered high severity due to the combination of CSRF and stored XSS.

No official patch or remediation is currently available for this vulnerability. Users of the frucomerci List of Posts from each Category plugin should monitor the vendor's advisory channels for updates. Until a fix is released, consider disabling or removing the plugin if feasible, or applying web application firewall (WAF) rules to block suspicious requests that may exploit CSRF or XSS. Avoid clicking on untrusted links while authenticated to the affected WordPress site.