The WPMK PDF Generator plugin contains a CSRF vulnerability that enables Stored XSS, posing a significant risk to site integrity and administrative sessions.

This vulnerability is classified as a Cross-Site Request Forgery (CWE-352), which can be leveraged by an unauthenticated attacker to inject malicious scripts that are stored by the application. Because the application fails to validate requests properly, an attacker can trick an authenticated administrator into executing unintended actions, leading to XSS within the site context.

The successful exploitation of this vulnerability can result in unauthorized actions performed on behalf of site administrators, potentially leading to full site compromise. With a CVSS score of 7.1, this is a High severity issue that could lead to the theft of sensitive user data, administrative session hijacking, or the defacement of the web application.

Immediate Action: Since a specific patch version is not currently listed, administrators should immediately disable or remove the WPMK PDF Generator plugin until an update addressing this flaw is released by the vendor.

Proactive Monitoring: Review web server and application access logs for suspicious POST requests originating from unexpected sources or targeting administrative settings pages.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust CSRF protection rules to block malicious requests before they reach the application layer.

Public Exploit Available: No (exploit_available unknown).

Given the High severity of this vulnerability and the potential for Stored XSS, organizations should prioritize the removal of the vulnerable plugin immediately. Maintain vigilance for vendor security bulletins and ensure that all web-facing software is audited for similar security gaps. Do not re-enable the plugin until a verified update is available and applied.