The vulnerability identified as CVE-2025-58991 involves a CSRF weakness in the WooCommerce Booking Bundle Hours plugin by Cristiano Zanca, which can be exploited to inject stored XSS payloads. This affects all versions up to 0.7.4. The CVSS 3.1 score of 7.1 indicates a network attack vector with low attack complexity, no privileges required, but user interaction is needed. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No patch or official fix has been documented yet.

Successful exploitation could allow an attacker to perform unauthorized actions via CSRF, leading to stored XSS that may compromise user sessions or inject malicious scripts. This can affect the confidentiality, integrity, and availability of the affected system. However, there are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying anti-CSRF tokens and restricting actions to trusted users. Monitoring plugin updates from the vendor is recommended.