CVE-2025-22292 describes a stored cross-site scripting vulnerability in the Powerful Auto Chat plugin by Felipe Peixoto. The flaw is due to improper input neutralization during web page generation, which can lead to the injection and execution of malicious scripts in the context of affected users. The vulnerability affects all versions up to 1.9.8. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impact on confidentiality, integrity, and availability at a low to medium level.

Successful exploitation of this vulnerability could allow an attacker with some privileges and requiring user interaction to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, modification of data, or disruption of service. The impact is rated medium based on the CVSS score of 6.5.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should exercise caution with input handling and consider applying any available workarounds recommended by the vendor once disclosed.