The vulnerability CVE-2025-30572 affects the Simple Rating plugin by Igor Yavych, versions up to and including 1.4. It is a Cross-Site Request Forgery (CSRF) issue that enables an attacker to perform Stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes low confidentiality, integrity, and availability impacts. No patch or mitigation details are currently available from the vendor or other sources.

Successful exploitation could allow an attacker to inject and store malicious scripts via CSRF, potentially leading to stored XSS attacks. This can result in partial compromise of confidentiality, integrity, and availability of the affected system. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as validating anti-CSRF tokens and sanitizing inputs to mitigate the risk of stored XSS. Monitor vendor channels for updates.