A CSRF vulnerability in the Rene Ade SensitiveTagCloud WordPress plugin allows unauthenticated attackers to execute Stored XSS, posing a significant risk to administrative sessions.

The plugin contains a CSRF vulnerability (CWE-352) that permits an unauthenticated attacker to inject malicious scripts into the application, resulting in Stored XSS. This occurs because the plugin fails to perform adequate request validation, allowing unauthorized actions to be performed on behalf of an authenticated user.

The exploitation of this vulnerability can lead to unauthorized script execution in the context of an administrator session, potentially resulting in account takeover, session hijacking, or the unauthorized modification of website content. With a CVSS score of 7.1, this represents a high-severity risk to the integrity and confidentiality of the affected WordPress site.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate and remove the SensitiveTagCloud plugin from their environments until a secure update is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious POST requests targeting the plugin's endpoints and review web traffic for unusual script injection patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common XSS payloads and restrict access to administrative interfaces.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate attention to prevent potential site compromise. Security teams should prioritize the removal of the vulnerable plugin and maintain a vigilant posture by monitoring for any signs of unauthorized administrative activity until such time as a verified, patched version is available from the vendor.