The vulnerability CVE-2025-23703 affects Free MailClient FMC versions up to 1.0 and involves Cross-Site Request Forgery (CSRF) that enables stored Cross-Site Scripting (XSS). An attacker can exploit this by tricking an authenticated user into submitting a crafted request, resulting in stored malicious scripts within the application. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no privileges, but requires user interaction. The impact includes partial confidentiality, integrity, and availability loss.

Successful exploitation of this vulnerability can lead to stored XSS attacks, which may allow attackers to execute malicious scripts in the context of the victim's browser session. This can result in unauthorized actions, data theft, or session hijacking. The CVSS score of 7.1 reflects a high severity with potential impacts on confidentiality, integrity, and availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with unsolicited links or requests that may trigger CSRF. Monitoring vendor channels for updates is recommended.