The vulnerability CVE-2025-25072 affects the thunderbax WP Admin Custom Page WordPress plugin (versions <= 1.5.0). It is a CSRF vulnerability that enables an attacker to execute stored XSS attacks by tricking an authenticated user into submitting a crafted request. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions within the WordPress admin context. This can compromise user data confidentiality, integrity, and availability of the affected site. The vulnerability requires user interaction but no privileges, increasing the risk to site administrators or users with admin access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or removing the affected plugin or restricting access to trusted users only. Monitoring for suspicious activity related to admin page requests may help detect exploitation attempts.