The WP Content Protection plugin for WordPress, developed by Shankaranand Maurya, contains a CSRF vulnerability that enables stored XSS attacks. This affects all versions up to 1.3. The vulnerability allows attackers to trick authenticated users into executing unwanted actions, resulting in stored malicious scripts. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability at a low level each. No patch or official fix details are available at this time.

Successful exploitation of this vulnerability could allow attackers to execute stored cross-site scripting attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This can compromise user data confidentiality, integrity, and availability to a limited extent. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP Content Protection plugin or applying any available temporary mitigations recommended by the vendor. Monitor official sources for updates regarding patches or workarounds.