The Recent Posts From Each Category plugin contains a CSRF vulnerability that facilitates Stored XSS, potentially compromising user sessions and site integrity.

This vulnerability is a Cross-Site Request Forgery (CWE-352) flaw that allows an unauthenticated attacker to inject malicious scripts into the application, resulting in Stored XSS.

The presence of a Stored XSS vulnerability poses a significant risk to the confidentiality and integrity of the affected website. Successful exploitation can lead to unauthorized actions performed on behalf of administrative users, session hijacking, or the defacement of web pages, which justifies its high severity score of 7.1.

Immediate Action: Since no official patch is currently identified, users should disable or remove the Recent Posts From Each Category plugin until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for unusual requests or suspicious POST activity directed toward the plugin configuration pages.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common CSRF and XSS payload patterns.

Public Exploit Available: Unknown.

Given the potential for Stored XSS and the current lack of a confirmed patch, immediate deactivation of the vulnerable plugin is the most effective mitigation strategy. Administrators should monitor official vendor channels for security releases and refrain from enabling the plugin until a verified fix is implemented.