CVE-2025-1324 is a stored cross-site scripting vulnerability in the WP-Recall – Registration, Profile, Commerce & More WordPress plugin. It occurs due to improper neutralization of input during web page generation, specifically in the 'public-form' shortcode. Authenticated attackers with contributor-level privileges or higher can inject arbitrary web scripts that execute in the context of other users viewing the injected pages. This vulnerability affects all plugin versions up to 16.26.10. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an authenticated contributor or higher to inject malicious scripts that execute in other users' browsers when they access the affected pages. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor's advisory for updates and apply any official fixes once released. Until a patch is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the 'public-form' shortcode to reduce exposure.