This vulnerability in ThemeFarmer Ultimate Subscribe (<= 1.3) allows attackers to perform Cross-Site Request Forgery (CSRF) attacks, potentially causing users to execute unwanted actions. Additionally, the issue enables reflected Cross-Site Scripting (XSS), which can be used to inject malicious scripts into web pages viewed by other users. There is no CVSS score or vendor patch information available. The vulnerability is published and assigned CVE-2025-23806 but lacks detailed technical or remediation data.

Successful exploitation could allow attackers to trick authenticated users into performing unintended actions on the Ultimate Subscribe plugin interface and inject malicious scripts via reflected XSS. This could lead to session hijacking, unauthorized changes, or other client-side impacts. However, no known exploits in the wild have been reported, and the exact impact depends on the context of use and user privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or limiting use of the Ultimate Subscribe plugin or applying custom CSRF protections and input validation to mitigate risk. Monitor official ThemeFarmer channels for updates.