The vulnerability identified as CVE-2025-28900 affects webgarb TabGarb Pro (versions up to 2.6) and involves a Cross-Site Request Forgery (CSRF) flaw that enables stored Cross-Site Scripting (XSS). This means an attacker could trick an authenticated user into submitting a forged request that results in malicious script being stored and executed within the application context. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and impacts to confidentiality, integrity, and availability at a low level. The vulnerability is published and assigned by Patchstack, but no patch or vendor advisory is currently available.

Successful exploitation could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed in the context of the victim user, data disclosure, or manipulation. The impact affects confidentiality, integrity, and availability at a low level but is significant enough to warrant attention due to the scope change and ease of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and validating user requests. Additionally, applying web application firewalls (WAF) rules that detect and block CSRF and XSS attempts may help mitigate risk. Monitor vendor channels for updates and patches.