The vulnerability CVE-2025-23558 affects digitalfisherman Geotagged Media (<= 0.3.0) and involves a Cross-Site Request Forgery (CSRF) flaw that enables stored Cross-Site Scripting (XSS). This means an attacker can trick an authenticated user into submitting unauthorized requests that result in malicious scripts being stored and executed within the application context. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low levels.

Successful exploitation could allow attackers to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed with the victim's privileges, data disclosure, data modification, or service disruption. The vulnerability impacts confidentiality, integrity, and availability at a low level but is considered high severity due to the combination of CSRF and stored XSS.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens and input sanitization to mitigate the risk of stored XSS. Monitor vendor channels for updates.