The vulnerability CVE-2025-25160 in Mark Barnes Style Tweaker (<= 0.11) is a CSRF issue that enables stored XSS attacks. An attacker can exploit this by tricking a user into submitting a crafted request that the application processes, leading to persistent malicious script injection. This affects the Style Tweaker plugin and can compromise user sessions or data through the stored XSS vector. The CVSS 3.1 score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of affected users, potentially stealing sensitive information, hijacking sessions, or performing unauthorized actions. The CSRF aspect means attackers can induce victims to perform unwanted actions without their consent. The combined impact affects confidentiality, integrity, and availability to a limited extent as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Style Tweaker plugin if feasible. Implementing CSRF protections such as anti-CSRF tokens and input sanitization may help mitigate risk. Monitor vendor channels for updates or patches addressing this vulnerability.