The vulnerability CVE-2025-46504 affects the Vasaio QR Code plugin by Olar Marius, specifically versions up to and including 1.2.5. It is a Cross-Site Request Forgery (CSRF) issue that enables stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The impact includes partial confidentiality, integrity, and availability loss. No vendor advisory or patch links are provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks by tricking an authenticated user into submitting a forged request. This can lead to unauthorized actions performed with the user's privileges, potentially compromising user data confidentiality, integrity, and availability to a limited extent. The CVSS score of 7.1 reflects a high severity level due to the combination of remote attack vector, low attack complexity, no privileges required, but user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted content and avoid interacting with suspicious links or sites that could exploit CSRF. Monitoring vendor channels for updates and applying patches promptly when released is recommended.