The Jenst Add to Header plugin up to version 1.0 contains a Cross-Site Request Forgery vulnerability that enables stored Cross-Site Scripting attacks. The vulnerability allows remote attackers to trick authenticated users into submitting unauthorized requests that result in malicious scripts being stored and executed. The CVSS 3.1 score of 7.1 reflects the network attack vector, low complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided by the vendor, and the plugin is not a cloud service. No known exploits have been reported.

Successful exploitation of this vulnerability can lead to stored XSS attacks, potentially allowing attackers to execute arbitrary scripts in the context of affected users. This can result in data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability requires user interaction but no privileges, increasing the risk to users of the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the affected plugin to mitigate risk. Monitor official Jenst advisories for updates and apply any official fixes promptly once released.