This vulnerability (CVE-2025-25168) affects the BookPress – For Book Authors plugin by Black and White, versions up to 1.2.7. It is a Cross-Site Request Forgery (CSRF) issue that enables Cross-Site Scripting (XSS) attacks. The CVSS v3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No patch or official remediation information is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker to trick an authenticated user into performing unwanted actions on the affected application, potentially leading to XSS attacks. This can result in partial compromise of confidentiality, integrity, and availability of the affected system. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted content and consider implementing CSRF protections or disabling the affected plugin if feasible.