CVE-2025-23617 is a CSRF vulnerability in cybio Floatbox Plus (<= 1.4.4) that enables stored XSS attacks. The vulnerability allows an attacker to trick a user into submitting unauthorized requests that result in persistent malicious scripts being stored and executed in the context of the affected application. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation can lead to stored XSS, allowing attackers to execute malicious scripts in users' browsers, potentially leading to data theft, session hijacking, or other malicious actions. The CSRF aspect means attackers can induce users to perform unintended actions without their consent. The combined impact affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate risk. Monitor for updates from the vendor regarding official fixes.