An unauthenticated attacker can exploit a CSRF vulnerability in the Taraprasad Swain HTACCESS IP Blocker plugin to execute Stored XSS, potentially compromising administrative sessions.

This vulnerability involves a Cross-Site Request Forgery (CWE-352) flaw that permits an unauthenticated attacker to inject malicious scripts into the plugin settings, resulting in Stored XSS. The attack requires user interaction, such as an administrator clicking a malicious link.

The successful exploitation of this vulnerability poses a significant risk to website integrity and user security. By leveraging Stored XSS via CSRF, an attacker can hijack administrative sessions, steal sensitive cookies, or perform unauthorized actions on behalf of a logged-in user, which justifies its High severity CVSS score of 7.1.

Immediate Action: Since a specific patch version is currently unknown, administrators should deactivate and remove the HTACCESS IP Blocker plugin until the vendor releases a secure update.

Proactive Monitoring: Review web server logs for suspicious POST requests targeting the plugin settings page and monitor for any unauthorized script injections in administrative dashboard areas.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block common CSRF and XSS attack patterns targeting the WordPress environment.

Public Exploit Available: No (exploit_available: false).

Given the potential for full administrative account compromise via Stored XSS, users must treat this vulnerability with high priority. We recommend immediate removal of the affected plugin to eliminate the attack surface until the vendor provides a verified security update.