The vulnerability CVE-2025-48309 affects the web-able BetPress plugin (versions up to 1.0.1 Lite) and involves Cross-Site Request Forgery (CSRF) that enables stored Cross-Site Scripting (XSS). This means an attacker can trick an authenticated user into submitting a forged request that results in malicious script being stored and executed in the context of the application. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed with the victim's privileges, data disclosure, or manipulation within the affected BetPress plugin. The impact affects confidentiality, integrity, and availability at a low to moderate level as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected BetPress plugin to mitigate risk. Implementing CSRF protections and input validation may reduce exposure, but official remediation guidance should be followed once published.