The Shamim Hasan Custom Functions Plugin up to version 1.1 contains a CSRF vulnerability that enables stored XSS attacks. This means an attacker can trick a user into submitting unauthorized requests that result in malicious scripts being stored and executed within the application context. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of affected users. This can compromise user data confidentiality, integrity, and availability. The vulnerability requires user interaction but no privileges, making it a significant risk for sites using the affected plugin versions. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.