The Sweet Energy Efficiency plugin for WordPress contains a CSRF vulnerability that enables Stored XSS, posing a significant risk of unauthorized script execution within an administrator's browser.

This vulnerability is a CSRF flaw that leads to Stored XSS, allowing an unauthenticated attacker to execute malicious scripts in the context of a victim's session when the victim performs a specific action.

The exploitation of this vulnerability can result in unauthorized actions performed on behalf of authenticated users, potentially leading to full site compromise if an administrator is targeted. With a CVSS score of 7.1, this flaw is categorized as High severity due to the potential for persistent malicious script injection, which can lead to data theft, session hijacking, or defacement.

Immediate Action: Users should immediately deactivate or remove the Sweet Energy Efficiency plugin until a security patch is released by the vendor.

Proactive Monitoring: Security teams should review web application logs for suspicious requests directed at plugin settings pages or unusual administrative activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious cross-site requests and filter malicious script patterns in inputs.

Public Exploit Available: No

Given the High severity of this vulnerability, immediate mitigation is required. Administrators should verify the availability of an update via the WordPress plugin repository and apply it as soon as it is released. If no patch is available, the plugin must remain disabled to prevent potential exploitation of the stored XSS vector.