The vulnerability CVE-2025-23980 concerns a CSRF issue in the Full Circle product by James Andrews, which can be exploited to inject stored XSS payloads. It affects versions up to 0.5.7.8. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No patch or mitigation details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized actions as an authenticated user via CSRF, potentially leading to stored XSS attacks. This can result in limited compromise of confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests. Monitoring for suspicious activity related to stored XSS may also be prudent.