CVE-2025-15690 is a stored Cross-Site Scripting (CWE-79) vulnerability in the Content Mask WordPress plugin versions before 1.8.5.6. The plugin fails to properly sanitize and escape user-submitted content before outputting it on generated pages. This allows users with a Contributor role or higher to inject malicious scripts that execute in the browsers of users who view or preview the affected pages. The plugin's built-in role restriction feature does not mitigate this issue.

Successful exploitation enables stored XSS attacks, allowing an attacker with Contributor-level access to execute arbitrary JavaScript in the context of other users' browsers. This can lead to session hijacking, defacement, or other malicious actions targeting users who view the compromised content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting Contributor-level users from submitting content through the plugin or disabling the plugin entirely to prevent exploitation.