CVE-2025-22278 describes a stored cross-site scripting vulnerability in the Whitish Lite theme by yudleethemes, affecting versions up to 2.1.13. The issue is due to improper neutralization of input during web page generation, which allows attackers to inject and store malicious scripts that execute when other users view the affected pages. The vulnerability has a CVSS 3.1 base score of 6.5, with attack vector network, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability classified as low. No patch or official fix information is available, and no known exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium severity based on the CVSS score of 6.5. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users of Whitish Lite up to version 2.1.13 should monitor vendor communications for updates. Until a fix is available, consider applying input validation or sanitization controls at the application or web server level to mitigate stored XSS risks.