This vulnerability involves a CSRF flaw in the Store Locator Widget component of Store Locator Widgets, allowing attackers to exploit the widget to store malicious scripts (stored XSS). The affected versions include all versions up to and including 2025r2. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction, and it impacts confidentiality, integrity, and availability at a low to medium level. No official patch or vendor advisory is available at this time.

Successful exploitation could allow an attacker to execute stored cross-site scripting attacks via CSRF, potentially leading to unauthorized actions performed on behalf of authenticated users, data manipulation, or other impacts on confidentiality, integrity, and availability as indicated by the CVSS score. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens and validating user requests in the Store Locator Widget environment. Monitor vendor channels for updates and patches.