The vulnerability CVE-2025-32645 affects the Custom Posts Order plugin by Hiren Patel, allowing CSRF attacks that can result in stored XSS. The affected versions are from an unspecified initial version through 4.4. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, but user interaction is needed. The vulnerability impacts confidentiality, integrity, and availability with low to partial impact on each. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized actions via CSRF, leading to stored XSS attacks. This can compromise user data confidentiality, integrity, and availability within the affected application environment. However, there are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected plugin to reduce exposure. Monitor vendor channels for updates and apply patches promptly once available.