The vulnerability CVE-2025-23694 affects the Shabbos and Yom Tov product by shabboscommerce and involves Cross-Site Request Forgery (CSRF) that enables stored XSS attacks. It impacts versions up to 1.9. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, but user interaction is needed. The vulnerability affects confidentiality, integrity, and availability to a low extent. No patch or vendor advisory is currently available.

Successful exploitation of this CSRF vulnerability can lead to stored XSS, allowing attackers to inject malicious scripts that persist on the application. This can compromise user sessions, steal sensitive information, or perform unauthorized actions. The impact affects confidentiality, integrity, and availability at a low level as per the CVSS vector. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests. Monitoring for suspicious activity related to stored XSS may also help mitigate risk.