The vulnerability CVE-2025-32498 affects the oleglark VKontakte Cross-Post plugin up to version 0.3.2. It is a Cross-Site Request Forgery (CSRF) issue that can lead to stored Cross-Site Scripting (XSS). The CVSS 3.1 base score is 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated as low to low. The vulnerability allows an attacker to trick an authenticated user into submitting a forged request, which can result in stored malicious scripts being executed in the context of the victim's browser.

Successful exploitation of this vulnerability can lead to unauthorized actions performed with the privileges of an authenticated user, and stored XSS can allow attackers to execute malicious scripts in users' browsers. This can compromise user data confidentiality, integrity, and availability to a limited extent. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin to reduce risk. Implementing standard CSRF protections such as anti-CSRF tokens and validating user requests may help mitigate the risk if feasible.