A CSRF vulnerability in the ptibogxiv Doliconnect plugin, affecting versions 9.5.7 and prior, allows unauthenticated attackers to execute Stored XSS attacks.

The vulnerability is a Cross-Site Request Forgery (CWE-352) that triggers Stored XSS. It allows an unauthenticated attacker to perform unauthorized actions on behalf of a user by tricking them into clicking a malicious link, which then injects persistent scripts into the application.

The exploitation of this vulnerability can lead to unauthorized data access, session hijacking, or the distribution of malicious content to other users of the platform. Given the CVSS score of 7.1, this represents a high-severity risk that could compromise the integrity and confidentiality of the affected web application.

Immediate Action: Users should immediately disable or remove the Doliconnect plugin until a patched version is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious requests involving the Doliconnect endpoint, specifically looking for unusual patterns that correlate with CSRF-like traffic.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block malicious XSS payloads and unexpected cross-site requests targeting the plugin's functionality.

Public Exploit Available: Unknown.

Due to the potential for Stored XSS, this vulnerability poses a significant risk to user data and session security. Administrators are advised to prioritize the removal or deactivation of the affected software and to wait for official confirmation of a security update from the vendor before re-enabling the component.