The vulnerability identified as CVE-2025-26578 affects mathieuhays Simple Documentation up to version 1.2.8. It is a Cross-Site Request Forgery (CSRF) issue that enables Stored XSS attacks by exploiting the client-documentation functionality. The CVSS score of 7.1 indicates a high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can allow an attacker to execute unauthorized requests as an authenticated user, potentially injecting stored malicious scripts (Stored XSS). This can lead to compromise of user data confidentiality, integrity, and availability within the affected application. There are no known exploits in the wild reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate risk. Monitor official channels for updates and apply patches promptly once released.