The Aaron Forgue Amazon Showcase WordPress Plugin up to version 2.2 contains a CSRF vulnerability that enables stored XSS attacks. This occurs because the plugin does not adequately verify the origin of requests, allowing attackers to trick authenticated users into submitting malicious requests. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available.

Successful exploitation can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the affected site, potentially compromising user data and site integrity. The CSRF aspect means attackers can induce authenticated users to perform unwanted actions, increasing the risk of unauthorized changes or data manipulation. The combined impact affects confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting its use to trusted administrators only. Employing web application firewalls (WAF) that can detect and block CSRF and XSS attempts may provide temporary protection. Monitor official sources for updates and patches from the vendor.