A CSRF-to-Stored XSS vulnerability in the Page Carbajal Custom Post Status plugin allows unauthenticated attackers to execute malicious scripts in the context of an administrator session.

This vulnerability utilizes a Cross-Site Request Forgery (CWE-352) vector to trigger Stored Cross-Site Scripting. An attacker can craft a malicious request that, when executed by an authenticated administrator, injects arbitrary web scripts into the application.

The ability to execute Stored XSS via CSRF poses a significant risk to the integrity and security of the WordPress instance. Successful exploitation could allow an attacker to hijack administrative sessions, modify site content, or redirect users to malicious domains, directly impacting site reputation and user trust. Given the CVSS score of 7.1, this is a High severity issue that requires immediate attention to prevent unauthorized administrative actions.

Immediate Action: As no specific patch version is currently identified, administrators should immediately deactivate and remove the Custom Post Status plugin until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at plugin-specific endpoints and monitor for unexpected changes in administrative settings or injected script tags within site content.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common CSRF patterns and validate referer headers to mitigate the risk of unauthorized cross-site requests.

Public Exploit Available: Unknown

Due to the severity of a combined CSRF and Stored XSS vulnerability, the risk of session compromise is high. IT administrators must prioritize the removal of the vulnerable plugin from all production environments immediately. Do not re-enable the software until the vendor provides a version confirmed to resolve this security flaw.