This vulnerability (CVE-2025-1239) is a stored XSS issue in WatchGuard Fireware OS 12.0 management interface. It allows an authenticated attacker with administrator privileges to inject malicious JavaScript code into the Blocked Sites list, which executes in the context of other management users accessing the interface. This could lead to session hijacking or other client-side attacks within the management UI. The vulnerability requires administrator-level authentication and user interaction (UI) to trigger. No vendor advisory or patch information is currently available.

An attacker with administrator privileges can execute arbitrary JavaScript in the management interface of other administrators, potentially compromising their sessions or performing unauthorized actions within the management UI. However, exploitation requires authenticated access with high privileges and user interaction. There is no indication of impact beyond the management interface or network-level compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity. Avoid sharing management interface access broadly. No official patch or workaround has been published by WatchGuard at this time.