The vulnerability identified as CVE-2025-48359 affects the ATT YouTube Widget developed by thaihavnn07, specifically versions up to and including 1.0. It is a Cross-Site Request Forgery (CSRF) issue that enables an attacker to perform stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 base score is 7.1, reflecting a high severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability in a limited manner. There is no indication of known exploits in the wild or vendor-provided patches at this time.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This could result in limited compromise of user data confidentiality, integrity, and availability. However, exploitation requires user interaction and the attacker does not need privileges on the target system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected ATT YouTube Widget or applying any available workarounds recommended by the vendor. Monitoring for updates from thaihavnn07 is advised.