The WpMobi WordPress plugin (versions <=0.0.3) suffers from a CSRF vulnerability (CWE-352) caused by missing or incorrect nonce validation on the handleSaveGeneralSettings function. An attacker can craft a forged request that, when executed by an authenticated administrator, modifies plugin settings and injects arbitrary web scripts via the app_name attribute. The vulnerability is exacerbated because the injected script executes on form re-rendering even if the input fails validation and is not persisted, enabling script execution in the administrator's browser.

An unauthenticated attacker can exploit this vulnerability by tricking a site administrator into performing an action (such as clicking a malicious link), leading to unauthorized modification of the plugin's General Settings and injection of arbitrary scripts in the administrator's browser. This results in limited integrity impact (modification of settings) and potential client-side script execution, but no direct confidentiality or availability impact is indicated.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, administrators should exercise caution when interacting with untrusted links or requests that could trigger plugin settings changes. Implementing additional CSRF protections or disabling the plugin until patched may reduce risk.