CVE-2025-15440 is a stored cross-site scripting vulnerability in the iONE360 configurator WordPress plugin affecting all versions up to 2.0.57. The issue stems from improper neutralization of input during web page generation, specifically in the Contact Form Parameters, which allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the injected pages. The vulnerability is classified under CWE-79 and has a CVSS v3.1 base score of 7.2 with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with scope change.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users visiting the affected pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. There is no reported impact on availability. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or restricting access to the vulnerable plugin or its contact form parameters to reduce exposure.