This vulnerability in the Edamam SEO, Nutrition and Print for Recipes plugin (versions up to 3.3) allows attackers to exploit a Cross-Site Request Forgery (CSRF) flaw that can lead to stored Cross-Site Scripting (XSS). The vulnerability enables an attacker to trick an authenticated user into submitting a forged request, which can result in persistent malicious scripts being stored and executed in the context of the affected application. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized actions performed with the privileges of an authenticated user, including the injection and storage of malicious scripts (stored XSS). This can compromise user data confidentiality, integrity, and availability within the affected application environment. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin and apply any recommended temporary mitigations from the vendor. Monitor official Edamam communications for updates on patches or workarounds.