The vulnerability CVE-2025-46435 affects the Yash Binani Time Based Greeting plugin (versions up to 2.2.2) and involves a Cross-Site Request Forgery (CSRF) flaw that enables stored Cross-Site Scripting (XSS). This means an attacker can trick an authenticated user into submitting a crafted request that stores malicious script code, which can then execute in the context of the victim's browser. The CVSS 3.1 base score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability with low to partial scope changes.

Successful exploitation of this vulnerability could allow attackers to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed with the victim's privileges, data disclosure, or service disruption. The impact affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin to mitigate risk. Implementing CSRF protections and input sanitization may reduce exposure but rely on vendor updates for full remediation.