The Savyour Affiliate Partner plugin contains a CSRF vulnerability that permits attackers to execute unauthorized requests on behalf of authenticated users. This vulnerability also facilitates Stored XSS attacks, where malicious scripts can be injected and persist within the application. The affected versions include all releases up to 2.1.4. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official vendor advisory has been provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow attackers to perform unauthorized actions via CSRF and inject persistent malicious scripts through Stored XSS. This may lead to partial compromise of user data confidentiality, integrity, and availability within affected installations. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens and applying input sanitization to mitigate Stored XSS risks. Monitor vendor channels for updates and apply patches promptly once released.