The vulnerability CVE-2025-58849 affects the Deepak S Hide Real Download Path plugin through a CSRF attack vector that enables Stored XSS. This means an attacker can trick an authenticated user into submitting a forged request that results in malicious script storage, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to Stored XSS, allowing attackers to execute arbitrary scripts in the context of affected users, potentially leading to session hijacking, data theft, or other malicious actions. The vulnerability affects confidentiality, integrity, and availability to a low degree but with a scope change, indicating the impact extends beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin to reduce risk. Implementing standard CSRF protections and input validation may help mitigate exploitation but are not confirmed as complete mitigations for this issue.