The vulnerability CVE-2025-27332 affects the gmnazmul Smart Maintenance & Countdown plugin, allowing CSRF attacks that can lead to stored XSS. The affected versions are up to and including 1.2. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, but user interaction needed. The vulnerability impacts confidentiality, integrity, and availability to a low or partial degree. No vendor advisory or patch information is currently provided, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized actions via CSRF, resulting in stored XSS that may compromise user data confidentiality, integrity, and availability to a limited extent. The attack requires user interaction but does not require privileges or authentication. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin and apply any recommended temporary mitigations from the vendor. Monitor vendor channels for updates regarding patches or official fixes.