The WPMK PDF Generator plugin for WordPress versions up to 1.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability that enables an attacker to execute stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 score of 7.1 reflects that the vulnerability can be exploited remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low to moderate level. The vulnerability is publicly disclosed but lacks an official patch or vendor advisory detailing remediation steps.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions on behalf of authenticated users. This may result in partial compromise of user data confidentiality, integrity, and availability within the affected application context. However, there are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WPMK PDF Generator plugin if feasible, or restrict access to trusted users only. Monitoring for updates from the vendor is recommended to apply any forthcoming patches promptly.