The vulnerability CVE-2025-22688 involves a CSRF flaw in the Unlimited Page Sidebars plugin by Ederson Peka, which can be exploited to inject stored XSS payloads. It affects versions up to and including 0.2.6. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation information is currently provided.

Successful exploitation could allow attackers to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions and compromise of user data or session integrity. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.