The Sudavar Codescar Radio Widget versions up to 0.4.2 contain a CSRF vulnerability that enables stored XSS attacks. An attacker could exploit this flaw by tricking an authenticated user into submitting a crafted request, resulting in malicious script storage and execution. The vulnerability is network exploitable without privileges but requires user interaction. The CVSS vector indicates low attack complexity, no privileges required, user interaction needed, and impacts confidentiality, integrity, and availability at a low level. No patch or official fix information is currently available.

Successful exploitation of this vulnerability could allow attackers to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This may result in partial compromise of confidentiality, integrity, and availability of the affected system. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests. Additionally, monitoring for suspicious activity related to the widget is advisable. Avoid relying solely on user interaction to prevent exploitation.