A critical CSRF vulnerability in the WP CMS Ninja Current Age Plugin allows unauthenticated attackers to execute Stored XSS, potentially leading to session hijacking or unauthorized administrative actions.

The plugin fails to implement adequate CSRF protection, allowing an unauthenticated attacker to trick a logged-in user into performing unintended actions, which subsequently results in the injection of malicious scripts into the application.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the browser of a compromised user, which may include site administrators. This can lead to the theft of session cookies, modification of website content, or the creation of unauthorized administrative accounts, posing a severe risk to the integrity and confidentiality of the WordPress environment. With a CVSS score of 7.1, this represents a high-severity threat that requires prompt attention.

Immediate Action: As no official patch is currently identified, users should immediately deactivate and remove the Current Age Plugin until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the plugin directory, and monitor administrative accounts for unauthorized creation or permission changes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust CSRF and XSS protection rules to block malicious payloads targeting the plugin's endpoints.

Public Exploit Available: Unknown.

Given the potential for Stored XSS, which can lead to complete site takeover if an administrator is targeted, this vulnerability presents a significant risk to organizational security. Administrators are strongly advised to prioritize the removal of the vulnerable plugin to neutralize the attack surface immediately. Continue to monitor the developer's official channels for the release of a patched version before considering re-deployment.