This vulnerability in Ultimate AJAX Login (<= 1.2.1) allows an attacker to exploit CSRF combined with reflected XSS to perform unauthorized actions with user privileges. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. The lack of patch or vendor advisory means remediation status is currently unknown.

Successful exploitation could allow attackers to execute unauthorized requests on behalf of authenticated users, potentially leading to data disclosure, modification, or disruption of service. The reflected XSS component may facilitate further attacks such as session hijacking or credential theft. The overall impact affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens and validating user requests. Also, review and restrict user permissions to minimize potential impact. Monitor vendor channels for updates or patches addressing this vulnerability.