A CSRF vulnerability in the CDN-Remote Images plugin for WordPress permits unauthenticated attackers to execute Stored XSS, potentially leading to unauthorized actions and script injection.

The plugin contains a CSRF vulnerability that allows an unauthenticated attacker to trigger Stored XSS. This occurs because the application lacks sufficient anti-CSRF protections on sensitive administrative endpoints, allowing an attacker to force a user to execute actions or inject malicious scripts without their consent.

The vulnerability carries a CVSS score of 7.1, indicating a high level of risk. Successful exploitation could lead to the theft of session cookies, defacement of the website, or unauthorized administrative actions, which may result in significant reputational damage and potential compromise of sensitive site data.

Immediate Action: Users should immediately disable or remove the CDN-Remote Images plugin until a security update is released by the vendor.

Proactive Monitoring: Review web server and WordPress access logs for unusual administrative activity or requests originating from unauthorized sources.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust CSRF and XSS protection rules to help block malicious requests targeting this plugin.

Public Exploit Available: No (exploit_available: unknown)

Given the severity of potential Stored XSS via CSRF, organizations should prioritize the removal of the vulnerable component. Monitor vendor communication channels closely for the release of a patched version to restore functionality safely.