The WP-EasyArchives plugin for WordPress contains a CSRF vulnerability that facilitates Stored XSS, posing a risk of unauthorized script execution within the user's browser.

This vulnerability is a Cross-Site Request Forgery (CWE-352) that enables Stored XSS. The flaw resides in the plugin functionality and requires an unauthenticated attacker to trick a user into performing an action, as indicated by the User Interaction (UI:R) requirement in the CVSS vector.

The exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the context of a victim's session. Given the CVSS score of 7.1, this is considered a High severity issue that could lead to session hijacking, unauthorized administrative actions, or the theft of sensitive user data.

Immediate Action: Since a specific patch is not confirmed, users should immediately deactivate and remove the WP-EasyArchives plugin until a secure version is released by the vendor.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous POST requests directed at the plugin endpoints and implement Content Security Policy (CSP) headers to mitigate potential XSS impacts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious cross-site requests and sanitize incoming traffic to the WordPress environment.

Public Exploit Available: No (exploit_available: false)

Due to the nature of CSRF and Stored XSS, this vulnerability presents a significant risk to site integrity and user security. Organizations utilizing the WP-EasyArchives plugin are advised to prioritize the removal or replacement of the component until an official security update is provided by the vendor to address the underlying flaw.