The Bg Orthodox Calendar plugin for WordPress, developed by Vadim Bogaiskov, contains a CSRF vulnerability that permits stored XSS attacks. This affects all versions up to 0.13.10. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch links are currently available.

Successful exploitation of this vulnerability can allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions on behalf of authenticated users. This can compromise user data confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or limiting its use to trusted environments. Applying general CSRF protections and input sanitization may reduce risk but are not confirmed mitigations for this specific issue.