The vulnerability identified as CVE-2025-23566 affects the Custom Post plugin (version <= 1.0) developed by syedamirhussain91. It is a CSRF vulnerability that enables stored XSS attacks by allowing unauthorized requests to be made on behalf of an authenticated user. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts that are stored and executed in the context of users interacting with the affected plugin. This can lead to session hijacking, data theft, or other malicious actions depending on the stored XSS payload. The vulnerability affects confidentiality, integrity, and availability to a low degree but is considered high severity due to the combination of CSRF and stored XSS.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory or official sources for current remediation guidance. Until a fix is released, users should consider disabling or limiting use of the affected plugin to reduce exposure.