The FanBridge signup plugin for WordPress contains a CSRF vulnerability that facilitates Stored XSS, potentially allowing an attacker to execute malicious scripts in a user's browser session.

The plugin is susceptible to Cross-Site Request Forgery (CWE-352), which an unauthenticated attacker can leverage to perform unauthorized actions and inject malicious scripts into the application.

Successful exploitation of this vulnerability could lead to unauthorized actions performed on behalf of legitimate users, including administrators. This may result in the theft of session cookies, unauthorized data modification, or the redirection of users to malicious sites, significantly impacting user trust and data integrity. Given the CVSS score of 7.1, this represents a high-severity risk that requires prompt attention to prevent potential account takeovers.

Immediate Action: Since a specific patch is not currently available, administrators should immediately deactivate and remove the FanBridge signup plugin until a secure version is released by the vendor.

Proactive Monitoring: Review web server and application logs for unusual POST requests directed at plugin endpoints, particularly those originating from unauthorized or unexpected referrers.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust CSRF protection rules to inspect incoming requests and block suspicious traffic targeting the vulnerable signup functionality.

Public Exploit Available: No — there is no evidence of a weaponized exploit or public proof-of-concept in the provided data.

Given the potential for Stored XSS via CSRF, this vulnerability poses a significant risk to site security and user privacy. Organizations currently utilizing the FanBridge signup plugin should prioritize its removal from their environments until the vendor provides a verified security update. Monitoring for anomalous activity remains essential while the plugin is being evaluated for continued use.