The Chaser324 Featured Posts Scroll plugin versions up to 1.25 contain a CSRF vulnerability that enables stored XSS attacks. An attacker can trick an authenticated user into submitting a forged request, which results in malicious script storage and execution. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality, integrity, and availability. No patch or official fix details are available, and the product is not a cloud service.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected application. This can compromise user data confidentiality, integrity, and availability to a limited degree. The vulnerability requires user interaction and some privileges, which somewhat limits exploitation scope. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of the Featured Posts Scroll plugin to mitigate risk. Applying web application firewalls or CSRF protections may help reduce exposure but are not guaranteed to fully mitigate the stored XSS risk.