The vulnerability identified as CVE-2025-31390 affects bdoga Social Crowd (up to version 0.9.6.1) and involves Cross-Site Request Forgery (CSRF) that enables stored Cross-Site Scripting (XSS). This means an attacker could trick an authenticated user into submitting a forged request that results in malicious script storage within the application. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is necessary. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability could allow attackers to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed in the context of the victim user. This may result in partial compromise of user data confidentiality, integrity, and availability within the affected Social Crowd application.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor's advisory channels for updates and apply any official fixes once released. Until then, consider implementing CSRF protections such as anti-CSRF tokens and validating user requests to mitigate risk.