The vulnerability CVE-2025-22806 affects Modernaweb Studio's Black Widgets For Elementor plugin, specifically versions up to 1.3.8. It is a DOM-based Cross-site Scripting (XSS) flaw resulting from improper neutralization of input during web page generation. The CVSS 3.1 base score is 6.5 (medium), with attack vector network, low attack complexity, low privileges required, user interaction required, and impacts on confidentiality, integrity, and availability rated as low. This vulnerability could allow an attacker to inject and execute malicious scripts in the victim's browser within the context of the vulnerable plugin.

Successful exploitation of this vulnerability could lead to limited confidentiality, integrity, and availability impacts within the affected web application due to DOM-based XSS. This may allow attackers to execute arbitrary scripts in the context of users interacting with the vulnerable plugin, potentially leading to session hijacking or other client-side attacks. However, exploitation requires user interaction and low privileges, reducing the overall risk. No known active exploits have been reported.

Patch status is not yet confirmed — no official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates and apply any official fixes once released. Until then, consider minimizing exposure by limiting user privileges and exercising caution with untrusted input in the affected plugin. Avoid relying on generic mitigations unless specifically recommended by the vendor.