CVE-2025-22807 describes a stored cross-site scripting vulnerability in the Robert Responsive Flickr Slideshow plugin (versions up to 2.6.0). The issue is caused by improper neutralization of input during web page generation, which allows attackers to inject and store malicious scripts that execute in the context of users viewing the slideshow. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, required privileges and user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation information is currently provided, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing the affected slideshow, potentially leading to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The medium severity score reflects these risks but also the requirement for some privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the affected plugin to mitigate risk. Monitor official Robert project communications for updates and apply any released fixes promptly.