This vulnerability involves a CSRF issue in the Reloadly product by iseremet, specifically in the reloadly-topup-widget component. The CSRF flaw enables an attacker to perform unauthorized actions on behalf of an authenticated user, which in this case leads to Stored XSS. The affected versions include all versions up to 2.0.1. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low level.

Successful exploitation can allow an attacker to execute stored cross-site scripting attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This can compromise user data confidentiality, integrity, and availability to a limited extent. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate risk.