The vulnerability CVE-2025-26568 involves a CSRF flaw in the Easy Amazon Product Information plugin by jensmueller, which enables Stored XSS attacks. The affected versions include all up to 4.0.1. This means an attacker could trick an authenticated user into submitting a crafted request that results in malicious script storage, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute stored malicious scripts within the context of the affected application, potentially leading to data theft, session hijacking, or other malicious actions. The CSRF aspect means the attacker can induce an authenticated user to perform unintended actions. The overall impact affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin and applying any recommended temporary mitigations from the vendor. Monitoring for updates from jensmueller or the plugin distribution source is advised.