The vulnerability CVE-2025-46524 affects the WP Filter Post Category plugin by stesvis, allowing CSRF attacks that result in Stored XSS. This means an attacker can trick an authenticated user into submitting a forged request that stores malicious script code, potentially impacting confidentiality, integrity, and availability. The affected versions include all versions up to and including 2.1.4. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and no privileges, requiring user interaction, and it affects confidentiality, integrity, and availability with low to high impact.

Successful exploitation of this vulnerability can lead to Stored XSS, which may allow attackers to execute arbitrary scripts in the context of the victim's browser. This can result in data theft, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of the affected system. The CVSS score of 7.1 reflects a high severity impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin or applying any available temporary mitigations recommended by the vendor. Monitor the vendor's communications for updates on patches or official fixes.