The WP Corner Quick Event Calendar plugin versions up to 1.4.9 contain a CSRF vulnerability that enables stored XSS attacks. An attacker can exploit this by tricking an authenticated user into executing unwanted actions, potentially injecting malicious scripts that persist in the application. This vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected site. This can result in session hijacking, defacement, or other malicious activities impacting confidentiality, integrity, and availability to a limited extent. The vulnerability requires user interaction but no privileges, making it accessible to remote attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a fix is available, users should exercise caution with the plugin and consider disabling or restricting its use to trusted users only.