The vulnerability CVE-2025-30586 affects the bbodine1 cTabs plugin (version <= 1.3) and is characterized as a Cross-Site Request Forgery (CSRF) that enables stored Cross-Site Scripting (XSS). This means an attacker can trick a user into submitting unauthorized requests that result in malicious scripts being stored and executed in the context of the affected application. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability can lead to stored XSS attacks, which may allow attackers to execute arbitrary scripts in the context of users interacting with the vulnerable cTabs plugin. This can result in theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high severity level, but no known active exploitation has been reported.

No official patch or remediation guidance is currently available for this vulnerability. Users of bbodine1 cTabs plugin should monitor vendor advisories for updates or patches. Until a fix is released, consider disabling or removing the affected plugin to mitigate risk. Avoid interacting with untrusted content that could trigger CSRF attacks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.