This vulnerability in x000x occupancyplan (<= 1.0.3.0) allows an attacker to exploit a Cross-Site Request Forgery (CSRF) flaw that enables unauthorized requests to be executed by authenticated users. Additionally, the vulnerability includes a Stored Cross-Site Scripting (XSS) component, which can be used to inject malicious scripts that persist on the application. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability with scope changed.

Successful exploitation could allow an attacker to perform unauthorized actions on behalf of a user due to CSRF and inject persistent malicious scripts via Stored XSS. This may lead to partial compromise of confidentiality, integrity, and availability of the affected system. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates. In the meantime, applying standard CSRF protections such as anti-CSRF tokens and input sanitization to mitigate Stored XSS risks is recommended if possible.