The vulnerability identified as CVE-2025-48146 affects the SEO Flow plugin by LupsOnline (version <= 2.2.1). It is a Cross-Site Request Forgery (CSRF) issue that enables attackers to execute stored XSS attacks by tricking authenticated users into submitting malicious requests. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates the attack can be performed remotely over the network with low complexity, no privileges required, but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There is no vendor advisory or patch link currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability can allow attackers to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed with the privileges of an authenticated user. This can result in partial loss of confidentiality, integrity, and availability of the affected system or data. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin and apply standard CSRF mitigations where possible. Monitor vendor channels for updates and patches addressing this vulnerability.