A Cross-Site Request Forgery vulnerability in the ERA404 LinkedInclude plugin allows unauthenticated attackers to execute Stored Cross-Site Scripting, posing a significant risk to site integrity.

This vulnerability occurs due to a lack of CSRF protection within the LinkedInclude plugin, which permits an unauthenticated attacker to trick a logged-in administrator into performing unintended actions, specifically leading to the injection of malicious scripts.

The exploitation of this flaw can lead to the unauthorized execution of JavaScript in the context of an administrator session, potentially resulting in full site compromise or data theft. With a CVSS score of 7.1, this is classified as a High severity issue, as it provides an attacker with the capability to manipulate administrative functions and inject persistent malicious content.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate and remove the LinkedInclude plugin until a secure version is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests directed at administrative endpoints or plugin-specific settings pages.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious cross-site requests and common XSS payloads targeting WordPress administrative interfaces.

Public Exploit Available: Unknown.

Given the High severity of this vulnerability and the potential for Stored XSS, organizations must treat this risk with urgency. Administrators are advised to prioritize the removal or containment of the affected software to prevent potential administrative account takeover or site-wide script injection.