The vulnerability identified as CVE-2025-23662 affects the WP Panoramio plugin by ryscript, specifically versions up to 1.5.0. It is a Cross-Site Request Forgery (CSRF) issue that enables stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 base score is 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability all rated low. No patch or official fix has been documented in the provided data. The vulnerability could allow an attacker to trick an authenticated user into submitting a crafted request that results in stored malicious script execution.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially compromising user sessions, stealing sensitive information, or performing unauthorized actions within the context of the affected WordPress site. The impact affects confidentiality, integrity, and availability at a low level but is significant enough to warrant attention due to the stored XSS component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or removing the WP Panoramio plugin if it is not essential. Additionally, implementing standard CSRF protections and input sanitization may help mitigate risk, but these are general recommendations and may not fully address this specific vulnerability.