The vulnerability CVE-2025-39433 affects the Bknewsticker plugin by beke_ro, allowing an attacker to exploit a Cross-Site Request Forgery (CSRF) weakness to inject stored Cross-Site Scripting (XSS) payloads. This affects all versions up to 1.0.5. The CVSS 3.1 score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of users interacting with the vulnerable plugin, potentially leading to session hijacking, data theft, or other malicious actions. The CSRF aspect means attackers can trick authenticated users into performing unwanted actions that store malicious scripts. The overall impact affects confidentiality, integrity, and availability at a low to medium level as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable Bknewsticker plugin or applying any available workarounds from the vendor. Monitoring vendor channels for updates is recommended.