CVE-2025-2078 is a stored cross-site scripting vulnerability in the BlogBuzzTime for WP WordPress plugin, affecting all versions up to and including 1.1. The vulnerability arises from improper neutralization of input during web page generation, specifically in admin settings, allowing authenticated users with administrator-level permissions to inject arbitrary scripts. These scripts execute when any user accesses the injected pages. The vulnerability only impacts multi-site WordPress installations or those where the unfiltered_html capability is disabled, limiting its scope. No official patch or fix has been provided as of the published date.

An authenticated attacker with administrator privileges can exploit this vulnerability to inject malicious scripts into pages, potentially leading to session hijacking, defacement, or other client-side attacks against users who visit the compromised pages. The impact is limited to multi-site or restricted unfiltered_html environments and requires high privileges, reducing the risk to lower-privileged users. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should restrict access to trusted users only and consider disabling or removing the BlogBuzzTime for WP plugin in multi-site or unfiltered_html-disabled environments. Monitoring for suspicious administrator activity may help detect exploitation attempts.