The 'Interactions – Create Interactive Experiences in the Block Editor' WordPress plugin by bfintal suffers from a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2025-12709. This vulnerability arises from improper neutralization of input during web page generation, specifically in event selectors, allowing authenticated users with Contributor or higher privileges to inject arbitrary JavaScript code. The injected scripts execute in the context of any user viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The issue affects all plugin versions up to 1.3.1. The CVSS 3.1 score of 6.4 reflects a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with a scope change. No patch or vendor advisory is currently provided, and no known exploits have been reported.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via event selectors. These scripts execute in the browsers of users who view the infected pages, potentially compromising user sessions or data confidentiality and integrity. The vulnerability does not affect availability. The medium severity rating (CVSS 6.4) reflects the need for authenticated access but the potential for impactful client-side attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid using the plugin or disable it if possible to reduce exposure. Follow vendor communications closely for official patches or updates.