This vulnerability in PluginsPoint Kento Splash Screen (<= 1.4) involves Cross-Site Request Forgery (CSRF) that enables stored Cross-Site Scripting (XSS). An attacker could trick an authenticated user into submitting a forged request, which results in malicious script storage and execution. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and affects confidentiality, integrity, and availability with limited impact.

Successful exploitation could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated high due to the combination of CSRF and stored XSS, but the overall confidentiality, integrity, and availability impacts are limited as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. In the meantime, applying standard CSRF protections such as verifying anti-CSRF tokens and limiting user privileges may reduce risk.