The vulnerability CVE-2025-39435 affects the My Marginalia plugin by davidfcarr, allowing CSRF attacks that can result in stored XSS. This means that an attacker could trick an authenticated user into submitting a request that stores malicious script code, potentially impacting confidentiality, integrity, and availability. The affected versions include all releases up to 1.0.6. No patch or vendor advisory has been provided to confirm remediation status.

Successful exploitation could allow an attacker to execute stored XSS via CSRF, potentially leading to session hijacking, data manipulation, or denial of service. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider disabling or restricting access to the affected plugin to mitigate risk. Monitor for updates from the vendor or trusted security sources.