CVE-2025-6063 is a CSRF vulnerability in the XiSearch bar WordPress plugin by dmitry78 affecting all versions up to 2.6. The issue stems from inadequate nonce validation on the 'xisearch-key-config' administrative page, enabling attackers to forge requests that can modify plugin settings or inject malicious web scripts if an administrator is tricked into clicking a crafted link. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and can be exploited remotely (AV:N).

Successful exploitation allows an attacker to perform unauthorized changes to plugin settings and inject malicious scripts via forged requests, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact. The vulnerability requires tricking an administrator into interacting with a malicious link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when interacting with untrusted links and consider restricting access to the 'xisearch-key-config' page or implementing additional CSRF protections manually.