The vulnerability CVE-2025-32481 in ninotheme Nino Social Connect plugin is a CSRF flaw that enables stored XSS attacks. It affects all versions up to 2.0. The CVSS score is 7.1 (high), with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes partial loss of confidentiality, integrity, and availability. No vendor advisory or patch information is available, and the product is not a cloud service.

Successful exploitation of this vulnerability allows an attacker to trick authenticated users into executing unwanted actions, resulting in stored XSS. This can lead to unauthorized disclosure of information, modification of data, and potential disruption of service. The CVSS vector indicates a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens and restricting actions to trusted users. Monitoring for suspicious activity related to stored XSS may also help mitigate risk.