CVE-2025-48078 describes a CSRF vulnerability in the Norbert Slick Google Map plugin (versions <= 0.3) that enables stored XSS attacks. The vulnerability allows attackers to trick authenticated users into submitting unauthorized requests, which can result in malicious scripts being stored and executed within the application context. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially compromising user data and session integrity. The CSRF aspect enables attackers to perform actions without the user's consent, increasing the risk of unauthorized changes or data manipulation. The overall impact is rated high due to combined confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the affected plugin version. Implementing CSRF protections such as anti-CSRF tokens and validating user inputs may help mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.