The vulnerability CVE-2025-58677 in puravida1976 ShrinkTheWeb (STW) Website Previews plugin is a CSRF issue that enables stored XSS attacks. It affects all versions up to 2.8.5. The vulnerability allows attackers to trick authenticated users into executing unwanted actions, which results in malicious scripts being stored and potentially executed in the context of the affected site. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The impact includes partial confidentiality, integrity, and availability loss. No patch or official fix information is currently provided.

Successful exploitation can lead to stored XSS, which may allow attackers to execute arbitrary scripts in users' browsers, potentially leading to data theft, session hijacking, or other malicious actions. The CVSS score of 7.1 reflects a high severity with impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor for updates from puravida1976 or the plugin maintainers. Until a fix is released, consider disabling the plugin or restricting its use to trusted users only to reduce exposure.