The vulnerability CVE-2025-23745 affects the Call me Now plugin by Tussendoor B.V., specifically versions up to 1.0.5. It is a Cross-Site Request Forgery (CSRF) issue that enables stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized actions on behalf of a user via CSRF, potentially leading to stored XSS attacks. This can result in limited compromise of user data confidentiality, integrity, and availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the affected plugin version. Implementing standard CSRF protections and input sanitization may help mitigate risk, but specific vendor guidance should be followed once published.