The WP-CalDav2ICS plugin for WordPress contains a CSRF vulnerability that enables stored XSS attacks. This means an attacker can trick an authenticated user into submitting a malicious request that results in persistent script injection. The vulnerability affects all versions up to 1.3.4. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low to medium level.

Successful exploitation could allow an attacker to execute persistent cross-site scripting attacks via forged requests, potentially leading to session hijacking, defacement, or other malicious actions within the context of the affected WordPress site. The impact includes partial loss of confidentiality, integrity, and availability as indicated by the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the WP-CalDav2ICS plugin or applying any temporary mitigations recommended by the vendor. Monitoring for updates from hoernerfranz is advised.