The vulnerability CVE-2025-52792 affects the WP User Stylesheet Switcher plugin by vgstef, allowing an attacker to exploit a CSRF weakness to inject stored XSS payloads. The CVSS 3.1 base score is 7.1 (high), with an attack vector of network, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The issue exists in all versions up to 2.2.0. No patch or official remediation information is currently available.

Successful exploitation could allow an attacker to execute stored cross-site scripting attacks via CSRF, potentially leading to unauthorized actions performed in the context of authenticated users, data disclosure, or manipulation. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP User Stylesheet Switcher plugin if feasible. Additionally, applying general CSRF mitigations such as enforcing anti-CSRF tokens and limiting plugin usage to trusted users may reduce risk.