The vulnerability CVE-2025-58859 affects the Add to Feedly extension by David Merinas, allowing CSRF attacks that result in stored XSS. This means an attacker can trick a user into executing unwanted actions that store malicious scripts, potentially compromising user data or session integrity. The affected versions include all versions up to 1.2.11. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low to medium level.

Successful exploitation of this vulnerability can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the victim's browser session. This can result in data theft, session hijacking, or other malicious actions. The CVSS score of 7.1 reflects a high severity impact on confidentiality, integrity, and availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users and administrators should monitor the vendor's communications for updates. Until a fix is available, consider disabling or restricting use of the Add to Feedly extension to mitigate risk.