The vulnerability CVE-2025-48153 affects the Import CDN-Remote Images plugin by Atakan Au, allowing CSRF attacks that result in Stored XSS. The affected versions include all up to 2.1.2. The CVSS 3.1 vector indicates that the attack can be performed remotely over the network with low complexity and no privileges, but requires user interaction. The vulnerability can lead to partial confidentiality, integrity, and availability impacts. There is no vendor advisory or patch information provided at this time.

Successful exploitation of this vulnerability can allow an attacker to execute stored cross-site scripting attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This can compromise user data confidentiality and integrity and may affect availability. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens and restricting user actions to trusted sources. Monitor for vendor updates regarding patches or official mitigations.