The vulnerability CVE-2025-48359 affects the ATT YouTube Widget developed by thaihavnn07, specifically versions up to and including 1.0. It is a Cross-Site Request Forgery (CSRF) vulnerability that enables stored Cross-Site Scripting (XSS) attacks. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability at a low level. No patch or official fix information is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This can result in partial compromise of confidentiality, integrity, and availability of the affected system. However, no known exploits in the wild have been reported, and the exact impact depends on the deployment context of the ATT YouTube Widget.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable ATT YouTube Widget to prevent exploitation. Implementing standard CSRF protections and input sanitization may help mitigate the risk, but these are general recommendations and may not fully address the vulnerability without an official patch.