The ab-tools Flags Widget up to version 1.0.7 contains a CSRF vulnerability that permits stored XSS attacks. An attacker can exploit this by inducing a victim to perform unintended actions that store malicious scripts within the widget, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to stored XSS, allowing attackers to execute malicious scripts in the context of the victim's browser. This can result in data theft, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction and can be triggered remotely without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.