The vulnerability CVE-2025-23870 affects the Copyright Safeguard Footer Notice plugin by wygk, allowing Cross-Site Request Forgery (CSRF) attacks that can result in stored Cross-Site Scripting (XSS). This means an attacker can trick an authenticated user into submitting a request that stores malicious script code, which can then execute in the context of the affected site. The vulnerability impacts versions up to 3.0. The CVSS 3.1 base score is 7.1, reflecting a high severity with network attack vector, low complexity, no privileges required, but requiring user interaction, and impacts confidentiality, integrity, and availability to a low degree.

Successful exploitation of this vulnerability could allow attackers to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed with the privileges of the victim user. This can compromise user data confidentiality, integrity, and availability to some extent. However, there are no known exploits in the wild currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates. Until a fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens and restricting user input to mitigate the risk of stored XSS via CSRF.