This vulnerability affects IP2Location World Clock versions up to 1.1.9 and combines CSRF with Stored XSS. The CSRF flaw allows attackers to trick authenticated users into executing unwanted actions without their consent. The Stored XSS component means malicious scripts can be permanently stored and executed in the context of the application, potentially compromising user data or session integrity. The CVSS vector indicates the attack can be performed remotely with low complexity and no privileges, requiring user interaction, and impacts confidentiality, integrity, and availability at a low level. No patch or official remediation guidance is currently available.

Successful exploitation could allow attackers to perform unauthorized actions on behalf of legitimate users and inject persistent malicious scripts into the application. This can lead to partial compromise of user data confidentiality, integrity, and availability. However, there are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens and input sanitization to mitigate Stored XSS risks. Monitor for updates from IP2Location regarding patches or official mitigations.