The page-carbajal Custom Post Status plugin versions up to 1.1.0 contain a CSRF vulnerability that enables an attacker to inject stored XSS payloads. This occurs because the plugin does not properly verify the origin of requests modifying post status, allowing an attacker to trick an authenticated user into submitting a malicious request. The vulnerability is rated with a CVSS 3.1 score of 7.1, indicating high severity with impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to stored XSS, which may allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, data theft, or further attacks. The CSRF aspect means that an attacker can induce an authenticated user to perform unwanted actions without their consent. The combined impact affects confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider disabling or removing the affected plugin or restricting access to trusted users only. Monitor for updates from the vendor or security advisories for a patch or official mitigation.