The vulnerability CVE-2025-49453 affects the BP Profile as Homepage plugin (version <= 1.1) developed by Jatinder Pal Singh. It is a Cross-Site Request Forgery (CSRF) vulnerability that enables an attacker to trick an authenticated user into submitting unwanted requests. This CSRF issue is coupled with a Stored Cross-Site Scripting (XSS) vulnerability, which could allow persistent injection of malicious scripts. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No patch or official fix information is available from the vendor or advisory sources.

Successful exploitation could allow an attacker to perform unauthorized actions on behalf of an authenticated user due to the CSRF vulnerability, and potentially execute persistent malicious scripts via Stored XSS. This can lead to partial compromise of user data confidentiality, integrity, and availability within the affected plugin context. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected plugin version. Employing standard CSRF protections and input sanitization may help mitigate risk, but specific vendor guidance is necessary for definitive remediation.