The Listings for Buildium plugin by Deepak Khokhar contains a CSRF vulnerability that enables Stored XSS attacks. This affects versions up to 0.1.5. The vulnerability allows attackers to trick authenticated users into executing unwanted actions, potentially injecting malicious scripts that persist in the application. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized actions performed with the privileges of an authenticated user, resulting in stored malicious scripts that may compromise user data confidentiality, integrity, and availability. This can degrade trust in the application and potentially allow further attacks leveraging the stored XSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user inputs to mitigate the risk. Monitoring for suspicious activity related to this plugin is advisable.