The vulnerability CVE-2025-24720 is a CSRF issue in the Sticky Buttons plugin by Wow-Company, affecting versions up to 4.1.1. It allows attackers to perform unauthorized actions by exploiting the trust a web application has in the user's browser. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts integrity and availability but not confidentiality. No patch or official remediation information is provided in the available data.

Successful exploitation of this CSRF vulnerability could allow attackers to cause limited integrity and availability impacts by tricking authenticated users into performing unintended actions. Confidentiality is not affected. There are no known exploits in the wild, and the medium severity reflects moderate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting actions to POST requests with proper validation. Monitor vendor communications for updates on patches or official mitigations.