The ZIPANG Simple Stripe plugin versions up to 0.9.17 are vulnerable to CSRF attacks that enable stored XSS exploitation. An attacker can trick an authenticated user into submitting a forged request, potentially leading to persistent script injection. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is needed. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability can allow attackers to execute stored XSS attacks via CSRF, potentially leading to session hijacking, unauthorized actions, or other malicious activities within the context of the affected application. The impact is rated high due to the combination of CSRF and stored XSS, affecting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests. Additionally, monitoring for unusual activity related to the plugin is advisable.