The Noindex by Path plugin is vulnerable to a CSRF-based Stored XSS attack that could allow unauthenticated attackers to execute arbitrary scripts in the context of an administrator session.

The plugin fails to implement adequate CSRF protection, enabling an attacker to trick a logged-in user into executing unintended actions that lead to the persistent injection of malicious scripts. This vulnerability is triggered by an unauthenticated remote attacker who induces a victim to perform a state-changing action.

The exploitation of this vulnerability poses a significant risk to organizational security by allowing the execution of unauthorized scripts within the browser of authenticated users. A successful attack could lead to session hijacking, unauthorized configuration changes, or the exfiltration of sensitive site data. With a CVSS score of 7.1, this represents a High severity risk that requires immediate prioritization.

Immediate Action: There is currently no confirmed patch available; administrators should immediately disable or uninstall the Noindex by Path plugin until a secure version is released.

Proactive Monitoring: Monitor web application logs for suspicious requests originating from external sources that target plugin-specific settings or administrative endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust CSRF protection rules to inspect incoming traffic and block requests that lack proper anti-forgery tokens.

Public Exploit Available: Unknown

Given the High severity of this vulnerability and the potential for persistent XSS execution, organizations must treat this issue with urgency. Because a patch is not currently available, the most effective mitigation is the immediate removal of the affected software from the environment to prevent potential compromise.