The vulnerability CVE-2025-58677 involves a CSRF issue in the ShrinkTheWeb (STW) Website Previews plugin by puravida1976, which allows an attacker to inject stored XSS payloads. This affects all versions up to 2.8.5. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low to medium level. No patch or official fix information is available at this time.

Successful exploitation of this CSRF vulnerability can lead to stored XSS, potentially allowing attackers to execute malicious scripts in the context of the affected website. This can compromise user data confidentiality, integrity, and availability. The vulnerability has a high severity rating (CVSS 7.1), but no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting the use of the affected plugin to reduce exposure. Implementing standard CSRF protections and input validation may help mitigate risk, but specific vendor guidance should be followed once released.