The alphasis Related Posts via Taxonomies plugin (version <= 1.0.1) contains a CSRF vulnerability that enables an attacker to inject stored XSS payloads. This occurs because the plugin does not properly verify the origin of requests, allowing malicious requests to be executed with the privileges of an authenticated user. The vulnerability is network exploitable without privileges but requires user interaction. The CVSS 3.1 vector indicates low attack complexity, no privileges required, user interaction needed, and impacts confidentiality, integrity, and availability at a low to low level.

Successful exploitation can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability affects confidentiality, integrity, and availability at a low level. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or limiting use of the affected plugin to reduce risk. Monitor official vendor channels for updates and apply any official fixes promptly once released.