The digitaldonkey Multilang Contact Form plugin versions up to 1.5 suffer from a CSRF vulnerability that enables stored XSS attacks. This means that an attacker can trick a user into submitting a malicious request that is processed by the vulnerable form, resulting in persistent script injection. The vulnerability is remotely exploitable without privileges but requires user interaction. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low to low levels.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the victim's browser. This can result in theft of sensitive information, session hijacking, or other malicious actions. The CSRF aspect allows these attacks to be triggered without the victim's explicit consent beyond initial interaction. The overall impact affects confidentiality, integrity, and availability at a low level but is significant due to the stored nature of the XSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable Multilang Contact Form plugin or applying custom CSRF protections and input sanitization to mitigate the risk. Monitor vendor channels for updates and patches.