A CSRF vulnerability in the loopus WP Attractive Donations System plugin allows unauthenticated attackers to perform stored cross-site scripting, posing a significant risk to site integrity and user session security.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability that enables unauthenticated attackers to execute Stored Cross-Site Scripting (XSS) within the application. By tricking an administrator into performing an action, an attacker can inject arbitrary scripts that execute in the context of the user session.

Successful exploitation of this vulnerability can result in the compromise of user sessions, unauthorized access to administrative functions, and the injection of malicious content into the website. Given the CVSS score of 7.1, this is a High severity issue that threatens the confidentiality and integrity of both the web platform and its visitors. Organizations face potential reputational damage if their site is used to deliver malicious scripts to users.

Immediate Action: Update the WP Attractive Donations System plugin to version 1.29 or the latest available version provided by the vendor.

Proactive Monitoring: Review web application logs for suspicious POST requests targeting the plugin's donation configuration endpoints and monitor for unexpected changes to site content.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common CSRF and XSS patterns, which can provide a temporary layer of protection while updates are being staged.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to the integrity of the affected WordPress environment. Administrators should verify the current version of the WP Attractive Donations System plugin immediately and apply the update to version 1.29 to eliminate the underlying flaw. Failure to patch may allow attackers to hijack sessions or inject persistent malicious code into the site.