This vulnerability in Toast Plugins Internal Link Optimiser allows an attacker to exploit CSRF to inject stored XSS payloads. The affected versions are up to 5.1.3. The CVSS vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The impact includes partial confidentiality, integrity, and availability loss. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation could lead to stored XSS via CSRF, potentially allowing an attacker to execute malicious scripts in the context of the affected application. This could result in partial loss of confidentiality, integrity, and availability as indicated by the CVSS vector. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider implementing CSRF protections and input validation as temporary mitigations if possible. Monitor official Toast Plugins communications for updates.