The Galaxy Weblinks Post Featured Video component up to version 1.7 contains a CSRF vulnerability (CVE-2025-60137) that could allow attackers to perform unauthorized actions by exploiting the trust of an authenticated user. The vulnerability has a CVSS score of 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and requiring user interaction. No official patch or mitigation guidance is currently provided, and no known exploits have been reported.

Successful exploitation of this CSRF vulnerability could allow an attacker to cause an authenticated user to perform unintended actions within the Post Featured Video component, potentially leading to limited integrity impact. There is no confidentiality or availability impact reported. No known exploits in the wild have been identified.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider implementing standard CSRF mitigations such as verifying anti-CSRF tokens on state-changing requests if possible. Monitor official Galaxy Weblinks communications for updates and apply any official fixes promptly once released.