The wpdevart Pricing Table builder plugin suffers from a CSRF vulnerability that enables stored XSS attacks. This affects all versions up to 1.5.3. The vulnerability allows attackers to trick authenticated users into executing unwanted actions, which can result in persistent malicious scripts being stored and executed in the context of the affected site. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability with low attack complexity.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the victim's browser. This can compromise user data confidentiality, integrity, and availability. The CSRF aspect means attackers can induce authenticated users to perform unintended actions, potentially escalating the impact. There are no reports of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates and apply patches promptly once released. Until a fix is available, consider disabling or removing the affected plugin to mitigate risk. Implementing standard CSRF protections and input validation can help reduce exposure but may require custom development.