TheMarketer versions up to and including 1.4.7 are affected by a Cross-Site Request Forgery (CSRF) vulnerability that enables an attacker to perform stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes partial loss of confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can allow an attacker to execute stored XSS payloads via CSRF, potentially leading to unauthorized actions performed on behalf of authenticated users, data manipulation, or disruption of service. The CVSS vector indicates that the attack can be launched remotely without privileges but requires user interaction. The scope change suggests that the vulnerability affects components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as anti-CSRF tokens and input sanitization to mitigate the risk of stored XSS. Monitor for updates from the vendor regarding patches or official mitigations.