The vulnerability CVE-2025-23715 affects RaymondDesign's Post & Page Notes plugin up to version 0.1.1. It involves a CSRF flaw that enables attackers to inject stored XSS payloads by tricking authenticated users into submitting crafted requests. The vulnerability has a CVSS 3.1 score of 7.1, reflecting its high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are available, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the victim's browser, potentially compromising user data and session integrity. The vulnerability affects confidentiality, integrity, and availability to a limited extent. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting the use of the affected plugin and apply web application firewall (WAF) rules to detect and block CSRF and XSS attempts related to this plugin. Monitor vendor channels for updates.