CSRF → XSS → Admin Takeover in listmonk (CVE-2025-58430)

A chain of issues in listmonk allows a Cross‑Site Request Forgery (CSRF) to trigger arbitrary JavaScript execution (XSS) in the admin’s browser, culminating in a full admin account takeover