The Instant Breaking News plugin for WordPress is vulnerable to a CSRF-based Stored XSS attack, which could allow an attacker to execute malicious scripts in the context of an administrator session.

This vulnerability is classified as a Cross-Site Request Forgery (CWE-352) that enables Stored XSS. The flaw allows an unauthenticated attacker to trick an authenticated user into performing unintended actions, resulting in the injection of malicious scripts into the application.

The ability to perform Stored XSS via CSRF poses a significant risk to the integrity and security of the WordPress site. An attacker could potentially steal administrative session cookies, redirect users to malicious websites, or modify site content, leading to unauthorized access and potential data exfiltration. Given the CVSS score of 7.1, this is considered a high-severity issue that requires prompt attention to prevent site compromise.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate and remove the Instant Breaking News plugin until a fix is provided by the vendor.

Proactive Monitoring: Review web server and WordPress access logs for unusual administrative activity or requests originating from unexpected sources that might indicate CSRF attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common CSRF and XSS patterns, providing a layer of defense while the plugin remains unpatched.

Public Exploit Available: Unknown.

Due to the potential for administrative account compromise, this vulnerability poses a significant risk to the security of the affected WordPress instance. Organizations should prioritize the removal of the vulnerable plugin until the vendor releases a secure update, and they should perform a thorough audit of their environment for any signs of unauthorized script execution.