The vulnerability CVE-2025-22780 in the wp-pano plugin for WordPress is a stored cross-site scripting issue caused by improper input neutralization during web page generation. This flaw allows an attacker with low privileges to inject malicious scripts that execute when other users view the affected pages, potentially leading to partial compromise of confidentiality, integrity, and availability. The affected versions include all releases up to 1.17. There is no vendor advisory or patch information currently available, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope change, with partial impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting access to the plugin and monitoring for suspicious activity. Avoid exposing the plugin to untrusted users and apply standard web application security controls where possible.