The WP CMS Ninja Current Age Plugin suffers from a CSRF vulnerability that enables stored XSS attacks. This occurs in versions up to 1.6, allowing attackers to trick authenticated users into submitting malicious requests that result in persistent script injection. The vulnerability has a CVSS 3.1 score of 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch links are currently available, and the plugin is not a cloud service.

Successful exploitation can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions. The CSRF aspect means attackers can induce authenticated users to perform unintended actions, compounding the risk. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Additionally, applying standard CSRF protections and input sanitization may reduce exposure, but these are not confirmed as effective without vendor guidance.