This vulnerability (CVE-2025-23639) affects MDC YouTube Downloader versions through 3.0.0 and involves a CSRF flaw that enables an attacker to perform stored XSS attacks. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is available, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute stored XSS via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user, impacting confidentiality, integrity, and availability of the affected system. The attack requires user interaction but no privileges, making it a significant risk for users of the affected software versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content or links related to MDC YouTube Downloader. Monitor for vendor updates regarding patches or mitigations.