The tosend.it Simple Poll plugin versions up to 1.1.1 contain a CSRF vulnerability that can be exploited to inject stored XSS payloads. This vulnerability allows attackers to trick authenticated users into executing unwanted actions, which can result in persistent XSS attacks. The CVSS score of 7.1 reflects the network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to stored XSS, enabling attackers to execute malicious scripts in the context of the victim's browser. This can compromise user data, session tokens, or perform actions on behalf of the user. The vulnerability affects confidentiality, integrity, and availability to a low degree but is significant due to the potential for persistent XSS combined with CSRF.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling the Simple Poll plugin or restricting its use to trusted users only. Implementing additional CSRF protections at the application or web server level may help mitigate risk.