A high-severity CSRF vulnerability in the PressPage Mavis HTTPS to HTTP Redirection plugin facilitates Stored XSS, posing a significant risk of unauthorized script execution within the user context.

The application is susceptible to a Cross-Site Request Forgery (CSRF) attack, which enables an unauthenticated attacker to inject malicious scripts into the application, resulting in Stored Cross-Site Scripting (XSS). This flaw occurs because the application fails to adequately validate requests, allowing attackers to manipulate settings or content in the context of an unsuspecting user.

The exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of administrative users, and the theft of sensitive information. With a CVSS score of 7.1, the vulnerability represents a High severity risk that could compromise the integrity and confidentiality of the web application and its visitors.

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate or remove the Mavis HTTPS to HTTP Redirection plugin until an official security update is released by the vendor.

Proactive Monitoring: Review web server and application logs for suspicious POST requests or unusual script tags being injected into page content.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block common CSRF and XSS attack patterns targeting your web infrastructure.

Public Exploit Available: No (exploit_available: false).

Given the High severity of this vulnerability and the potential for Stored XSS, organizations should prioritize the removal of the affected plugin from production environments. Monitor official vendor channels closely for the release of a patched version and ensure that security policies regarding plugin vetting are strictly enforced.