The vulnerability identified as CVE-2025-23649 affects Kreg Steppe's Auphonic Importer versions up to 1.5.1. It is a CSRF issue that enables an attacker to execute stored XSS attacks by tricking a user into submitting unauthorized requests. The CVSS v3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow attackers to execute stored XSS payloads via CSRF, potentially leading to unauthorized actions performed in the context of the victim user. This can compromise confidentiality, integrity, and availability of the application or user data to a limited extent as indicated by the CVSS vector.

No official patch or remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens and validate user inputs to mitigate the risk of stored XSS.