The vulnerability CVE-2025-58806 affects the WordPress Error Monitoring plugin by Bugsnag (versions up to 1.6.3). It is a Cross-Site Request Forgery (CSRF) issue that enables an attacker to inject stored Cross-Site Scripting (XSS) payloads. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The vulnerability impacts confidentiality, integrity, and availability at a low level. No patch or official remediation guidance is currently provided, and no exploits have been observed in the wild.

Successful exploitation could allow an attacker to execute stored XSS attacks via CSRF, potentially leading to unauthorized actions performed in the context of an authenticated user. This may result in partial compromise of user data confidentiality, integrity, and availability. However, exploitation requires user interaction and the presence of the vulnerable plugin version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the affected plugin or restricting access to trusted users only. Monitor official channels for updates from the vendor or security advisories.