CVE-2025-52781 describes a CSRF vulnerability in the Beee TinyNav plugin (versions up to 1.4) that enables stored XSS attacks. The vulnerability allows an attacker to trick an authenticated user into submitting a forged request that results in malicious script storage and execution. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The impact includes partial confidentiality, integrity, and availability loss. No vendor patch or advisory is currently available to confirm remediation status.

Successful exploitation can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious actions. The CVSS score of 7.1 reflects a high impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected TinyNav versions and apply web application firewall rules to detect and block CSRF and XSS attack patterns where possible.