This vulnerability in Yaidier WN Flipbox Pro (<= 2.1) allows an attacker to exploit CSRF to perform unauthorized actions on behalf of an authenticated user. The issue also involves reflected XSS, which can be leveraged to execute malicious scripts in the context of the victim's browser. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, but user interaction is needed. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation could allow an attacker to execute unauthorized actions via CSRF and inject reflected XSS payloads, potentially leading to limited data disclosure, modification, or disruption of service. The overall impact is rated high due to the combination of CSRF and reflected XSS vulnerabilities affecting the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected plugin to mitigate risk. Monitor vendor communications for updates on patches or official mitigations.