The Jupitercow WP sIFR plugin for WordPress, versions up to 0.6.8.1, contains a CSRF vulnerability that enables stored XSS attacks. This means that an attacker can trick an authenticated user into submitting a crafted request that stores malicious script code within the application, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges, requires user interaction, and affects confidentiality, integrity, and availability with low to partial impact.

Successful exploitation could allow an attacker to execute stored malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS score. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP sIFR plugin if feasible, or apply any recommended temporary mitigations from the vendor. Monitor official Jupitercow or WordPress security channels for updates.