The vulnerability CVE-2025-25156 affects the Quote Comments plugin by Stanko Metodiev, allowing CSRF attacks that can result in Stored XSS. This means an attacker could trick an authenticated user into submitting a request that stores malicious script code in the application, potentially impacting confidentiality, integrity, and availability. The vulnerability affects all versions up to 3.0.0. The CVSS v3.1 base score is 7.1, with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. No patch or vendor advisory is currently available.

Successful exploitation could allow an attacker to execute stored malicious scripts via CSRF, impacting confidentiality, integrity, and availability of the affected system. This could lead to unauthorized actions performed in the context of an authenticated user and persistent XSS payloads stored in the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing CSRF protections such as anti-CSRF tokens and validating user input to mitigate the risk of stored XSS. Monitor official sources for updates from the vendor regarding patches or official fixes.