CVE-2025-15692: CWE-79 Cross-Site Scripting (XSS) in Icegram Express

The Icegram Express WordPress plugin versions prior to 5.8.6 improperly handle escaping of a list description setting when outputting it inside an HTML attribute. This improper sanitization enables users with Administrator privileges or higher to perform stored Cross-Site Scripting (CWE-79) attacks. The vulnerability is classified with a CVSS 3.1 base score of 3.5, reflecting low severity due to the requirement of high privileges and user interaction. No official remediation level or patch link is provided in the available data.

Successful exploitation allows an attacker with Administrator or higher privileges to inject and store malicious scripts within the plugin's list description setting. This can lead to execution of arbitrary scripts in the context of the affected WordPress site, potentially compromising confidentiality and integrity of data accessible to the administrator. There is no reported impact on availability. The low CVSS score reflects the limited scope and required privileges for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, administrators should monitor the vendor's announcements for updates. Until a fix is available, restrict Administrator role assignments to trusted users only and consider limiting access to the affected plugin's settings to reduce risk.