This vulnerability involves a CSRF flaw in the Pham Thanh Call Now PHT Blog plugin (<= 2.4.1) that enables stored XSS attacks. An attacker could exploit this by tricking an authenticated user into submitting a crafted request, which results in malicious scripts being stored and executed in the context of the vulnerable application. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low to partial level.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected application. This can compromise user data confidentiality, integrity, and availability. The CSRF nature of the vulnerability means attackers can induce authenticated users to perform unwanted actions without their consent. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to mitigate risk. Implementing standard CSRF protections and input validation may reduce exposure, but these are not confirmed as effective for this specific vulnerability.