This vulnerability (CVE-2025-26569) in Callmeforsox Post Thumbs is a CSRF issue that enables Stored XSS attacks. It affects all versions up to 1.5. The CVSS 3.1 score of 7.1 indicates high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows an attacker to trick authenticated users into submitting unauthorized requests that result in stored malicious scripts (Stored XSS). This can lead to compromise of user sessions, data integrity, and availability of the affected application. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests to mitigate risk. Avoid clicking on suspicious links while authenticated to the affected application.