CVE-2025-1267 is a stored Cross-Site Scripting vulnerability in the Groundhogg plugin for WordPress, affecting versions up to and including 3.7.4.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'label' parameter. An attacker with administrator privileges can inject arbitrary scripts that execute in the context of users visiting the affected pages. This vulnerability is limited to multi-site WordPress installations or installations where the unfiltered_html capability is disabled, restricting its scope. The CVSS 3.1 base score is 5.5, reflecting medium severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

An authenticated attacker with administrator-level access can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of users visiting the affected pages. This can lead to theft of sensitive information, session hijacking, or other actions performed with the victim's privileges. The impact is limited to confidentiality and integrity, with no direct availability impact. The vulnerability only affects multi-site WordPress installations or those with unfiltered_html disabled, limiting the affected user base.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider disabling multi-site features or enabling unfiltered_html capability if feasible. Monitor vendor channels for updates and apply patches promptly once released.