This vulnerability in PluginsPoint Kento Splash Screen (<= 1.4) allows an attacker to perform CSRF attacks that result in Stored XSS. The CVSS 3.1 score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability. The vulnerability enables an attacker to inject malicious scripts that persist on the affected system via CSRF, potentially affecting users who interact with the compromised interface.

Successful exploitation could allow an attacker to execute stored malicious scripts in the context of affected users, potentially leading to data exposure, modification, or disruption of service. The impact is limited to confidentiality, integrity, and availability at a low level but is significant enough to warrant attention due to the stored XSS component combined with CSRF.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are available at this time. Until a patch is released, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate the risk. Monitor vendor communications for updates.