The vulnerability identified as CVE-2025-58856 affects the ablancodev Woocommerce Notify Updated Product plugin for WooCommerce, versions up to 1.6. It is a CSRF vulnerability that enables stored XSS attacks, potentially allowing an attacker to inject malicious scripts via forged requests. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact includes integrity and availability loss but no confidentiality impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation can lead to stored XSS via CSRF, which may allow attackers to inject malicious scripts that affect the integrity and availability of the affected system. There is no indication of confidentiality compromise. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor vendor channels for updates regarding patches or official mitigations.