The youtag ShowTime Slideshow plugin versions up to 1.6 contain a CSRF vulnerability that enables stored XSS attacks. An attacker can exploit this by tricking an authenticated user into submitting a crafted request, resulting in malicious script storage and execution within the application context. This vulnerability has a CVSS 3.1 base score of 7.1, reflecting its high severity due to the combination of network accessibility, low complexity, and impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to unauthorized actions performed with the privileges of an authenticated user, including the injection and storage of malicious scripts (stored XSS). This can compromise user data confidentiality, integrity, and availability within the affected application. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens and restricting user input to mitigate stored XSS risks. Monitor vendor channels for updates and apply patches promptly once released.