ERA404 LinkedInclude versions up to 3.0.4 contain a CSRF vulnerability that enables stored XSS attacks. This means an attacker can trick an authenticated user into submitting a forged request that results in malicious script storage and execution. The vulnerability is network exploitable without privileges and requires user interaction. The CVSS vector indicates low attack complexity, no privileges required, but user interaction is necessary, and the impact includes confidentiality, integrity, and availability losses.

Successful exploitation could allow an attacker to execute stored malicious scripts in the context of the vulnerable application, potentially leading to data disclosure, data modification, or disruption of service. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider mitigating CSRF risks by implementing standard CSRF protections such as anti-CSRF tokens and validating user requests. Monitor vendor channels for updates.