The vulnerability CVE-2025-23691 affects the Send to Twitter plugin developed by Braulio Aquino. It is a CSRF issue that can lead to stored XSS attacks. The affected versions include all versions up to 1.7.2. The CVSS 3.1 base score is 7.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No official patch or vendor advisory is available at this time.

Successful exploitation of this vulnerability could allow attackers to perform unauthorized actions via CSRF, resulting in stored XSS that may compromise user data confidentiality, integrity, and availability to a limited extent. The scope change in the CVSS vector suggests the vulnerability affects components beyond the initially vulnerable component. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of the Send to Twitter plugin to mitigate risk. Monitor for any vendor updates or patches addressing this vulnerability.