A CSRF vulnerability in the Social Profilr plugin for WordPress allows attackers to execute Stored XSS, potentially leading to unauthorized actions and script execution in the context of a victim's session.

This vulnerability is a Cross-Site Request Forgery (CWE-352) that enables Stored XSS. The attack vector is network-based and does not require authentication, though it does require user interaction (UI:R).

The exploitation of this flaw can lead to the unauthorized execution of scripts within a user's browser session, which may result in data theft or session hijacking. Given the CVSS score of 7.1, this is considered a High severity vulnerability that poses a significant risk to the integrity and confidentiality of user accounts and administrative interfaces.

Immediate Action: Since no patch is currently identified, users should immediately deactivate and remove the Social Profilr plugin from their environment until a secure version is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous requests originating from external sources targeting the plugin's endpoints, particularly those associated with profile updates or configuration changes.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious traffic and detect common CSRF and XSS patterns, providing a layer of protection while the plugin remains unpatched.

Public Exploit Available: Unknown.

Due to the risk of Stored XSS, organizations should prioritize the removal of the vulnerable plugin. Administrators are advised to monitor the vendor and security databases for updates and only re-enable the software once a verified fix has been applied.