This vulnerability in the Wp Custom CMS Block plugin enables CSRF attacks that can result in stored XSS. An attacker could trick an authenticated user into submitting a forged request, which the plugin processes, leading to persistent script injection. The affected versions include all versions up to 2.1. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and no privileges, requiring user interaction, and impacts confidentiality, integrity, and availability at a low to moderate level.

Successful exploitation could allow an attacker to inject malicious scripts stored within the application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or limiting its use to trusted environments. Implementing anti-CSRF tokens and validating user requests may help mitigate the risk. Monitor vendor channels for updates and apply patches promptly once available.