The vulnerability identified as CVE-2025-25137 affects the Social Links plugin by kareemsultan, versions up to and including 1.0.11. It is a Cross-Site Request Forgery (CSRF) flaw that enables attackers to inject stored XSS payloads. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and low impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This can compromise user data confidentiality and integrity and may affect availability to a limited degree. However, exploitation requires user interaction and some privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected Social Links plugin version. Employing web application firewalls or CSRF protection mechanisms may help mitigate risk, but these are not confirmed as complete mitigations for this specific issue.