The vulnerability CVE-2025-53308 affects the gopi_plus Image Slider With Description plugin (versions up to 9.2). It is a CSRF vulnerability that enables stored XSS attacks by allowing unauthorized requests to be made on behalf of an authenticated user. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No patch or official fix has been disclosed yet.

Successful exploitation of this vulnerability could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions, data manipulation, or disruption of service within the affected application. The impact affects confidentiality, integrity, and availability as indicated by the CVSS vector. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying anti-CSRF tokens, restricting user permissions, or disabling the vulnerable plugin if feasible. Monitor vendor channels for updates.