The vulnerability CVE-2025-58848 affects the WP likes plugin by aakash1911, specifically versions up to 3.1.1. It involves a Cross-Site Request Forgery (CSRF) flaw that can be leveraged to perform reflected Cross-Site Scripting (XSS) attacks. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low to moderate level. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker to trick an authenticated user into performing unwanted actions on the WP likes plugin via CSRF, combined with reflected XSS, potentially leading to partial compromise of user data confidentiality, integrity, and availability. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider disabling or removing the affected WP likes plugin versions or applying any available temporary mitigations recommended by the vendor once the advisory is published.