The WP-CalDav2ICS plugin is vulnerable to a Cross-Site Request Forgery flaw that enables Stored Cross-Site Scripting, posing a significant risk of unauthorized action execution and malicious script injection.

This vulnerability is a Cross-Site Request Forgery (CWE-352) that permits an unauthenticated attacker to trick a legitimate user into performing unintended actions, which subsequently facilitates Stored Cross-Site Scripting within the application.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of an authenticated user session, potentially leading to unauthorized data access or administrative account compromise. Given the CVSS score of 7.1, this represents a high-severity threat that could lead to significant reputational damage and data integrity loss if malicious scripts are injected into the site.

Immediate Action: Users should immediately disable or remove the WP-CalDav2ICS plugin until a verified security update is released by the vendor.

Proactive Monitoring: Security teams should monitor web access logs for suspicious requests targeting the plugin and look for anomalous script-like content appearing in administrative interfaces.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter out common CSRF and XSS attack patterns, providing a temporary layer of protection while waiting for a vendor patch.

Public Exploit Available: Unknown

Due to the nature of CSRF-to-XSS chains, this vulnerability presents a serious risk to site integrity and user security. Administrators are strongly advised to prioritize the removal or deactivation of the affected component until an official security release is available to address the underlying flaw.