The vulnerability CVE-2025-39416 affects Ichi translit it! versions up to 1.6 and involves Cross-Site Request Forgery (CSRF) that enables Stored Cross-Site Scripting (XSS). This means an attacker can trick a user into submitting unauthorized requests that result in malicious scripts being stored and executed in the context of the application. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability could allow attackers to execute stored malicious scripts within the application context, potentially leading to data disclosure, data manipulation, or denial of service conditions. The impact affects confidentiality, integrity, and availability at a low level but is significant enough to be rated high severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor the vendor's communications for updates. In the meantime, applying standard CSRF protections and input validation where possible may reduce risk, but no vendor-acknowledged mitigation is currently documented.