The vulnerability CVE-2025-22661 involves improper neutralization of input in the vcita Online Payments plugin, specifically in the paypal-payment-button-by-vcita component. This flaw allows an attacker to inject and store malicious scripts that execute when a user views the affected web page, constituting a stored cross-site scripting (XSS) attack. The affected product versions are up to 3.20.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS score of 6.5 reflects a medium impact severity. No known exploits have been reported, and the extent of active exploitation is currently unknown.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider applying input validation or output encoding controls where possible to mitigate stored XSS risks. Avoid clicking on suspicious links or inputs related to the affected plugin.