No CSRF token present in Customer service message form.

A CSRF vulnerability exists in PayPal’s “Customer Service Message” form, which allows sellers to configure a personalized message shown to customers when they open a dispute. The form lacks anti-CSRF token, allowing an attacker to craft a malicious page that silently updates the message on behalf of an authenticated user.