The vulnerability identified as CVE-2025-22538 affects the Ofek Nakar Virtual Bot software up to version 1.0.0. It is a Cross-Site Request Forgery (CSRF) flaw that enables stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 base score is 7.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No patch or mitigation details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The scope change in the CVSS vector indicates that the vulnerability may affect components beyond the initially vulnerable component. However, no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. Until a patch is available, consider applying any recommended temporary mitigations from the vendor if published.