The vulnerability CVE-2025-31393 affects vfvalent Social Bookmarking RELOADED versions up to 3.18 and involves Cross-Site Request Forgery (CSRF) that enables stored Cross-Site Scripting (XSS). An attacker can trick a user into submitting a forged request that the application processes with the user's privileges, potentially leading to persistent XSS attacks. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information provided, and the product is not a cloud service, so remediation status is unknown.

Successful exploitation can allow attackers to execute stored XSS attacks via CSRF, potentially compromising user data confidentiality, integrity, and availability within the affected application. Since no privileges are required and the attack vector is network-based, the vulnerability poses a significant risk to users interacting with the vulnerable plugin. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin to reduce risk. Monitor vendor channels for updates regarding patches or official mitigations.