The vulnerability CVE-2025-32667 affects fromdoppler Doppler Forms through version 2.5.1 and involves a Cross-Site Request Forgery (CSRF) flaw that allows an attacker to cause stored Cross-Site Scripting (XSS). This means an attacker can craft a request that, when executed by an authenticated user, stores malicious script code within the application, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The vulnerability is confirmed published but lacks vendor patch or mitigation details.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of affected users. This can result in information disclosure, session hijacking, or manipulation of application data. The CVSS score of 7.1 reflects a high impact on confidentiality, integrity, and availability. However, no known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens and input validation to mitigate risk. Monitoring vendor communications for updates is recommended.