The vulnerability CVE-2025-23661 affects the ryscript NV Slider plugin (versions <= 1.6) and involves a Cross-Site Request Forgery (CSRF) flaw that enables stored Cross-Site Scripting (XSS). This means an attacker can trick an authenticated user into submitting a forged request that results in malicious script being stored and executed in the context of the affected application. The CVSS 3.1 base score is 7.1, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated as low.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS via CSRF, potentially leading to unauthorized actions performed with the privileges of the victim user. This can compromise confidentiality, integrity, and availability of the affected system to a limited extent. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider applying temporary mitigations such as disabling the affected plugin or restricting access to trusted users only, if feasible.