The vulnerability identified as CVE-2025-24636 affects the MachForm Shortcode plugin by Rick Laymance. It is a Cross-Site Request Forgery (CSRF) issue that enables stored Cross-Site Scripting (XSS). The affected versions include all versions up to 1.4.1. The CVSS 3.1 base score is 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and low impacts on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to trick an authenticated user into submitting a forged request that results in stored XSS. This can lead to unauthorized script execution in the context of the affected application, potentially compromising user data and application integrity. The CVSS score reflects a high severity due to the combination of CSRF and stored XSS impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected MachForm Shortcode plugin versions. Applying web application firewall (WAF) rules to detect and block CSRF and XSS attempts may provide temporary mitigation. Monitor vendor channels for updates and patches.