The vulnerability CVE-2025-23690 affects ArtkanMedia's Book a Place product through version 0.7.1. It is a Cross-Site Request Forgery (CSRF) issue that enables Stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. The vulnerability allows an attacker to trick an authenticated user into submitting malicious requests that result in persistent XSS payloads stored by the application.

Successful exploitation of this vulnerability can lead to unauthorized actions performed with the privileges of the victim user and persistent XSS attacks. This can result in information disclosure, session hijacking, or other malicious activities depending on the stored XSS payload. The overall impact is rated as high severity based on the CVSS score of 7.1.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate the risk of exploitation.