The vulnerability identified as CVE-2025-25147 affects the Phillip.Gooch Auto SEO plugin (versions up to 2.5.6). It is a Cross-Site Request Forgery (CSRF) issue that enables stored Cross-Site Scripting (XSS) attacks. This means that an attacker can trick an authenticated user into submitting a request that results in malicious script storage, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed with the privileges of an authenticated user. This could compromise user data confidentiality, integrity, and availability to a limited extent as indicated by the CVSS score. There are no known exploits in the wild at this time.

No official patch or remediation guidance is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, applying general CSRF mitigations such as disabling or restricting the use of the affected plugin, or limiting user privileges, may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.