The vulnerability CVE-2025-23824 in Alexander Weleczka FontAwesome.io ShortCodes is a CWE-79 type stored cross-site scripting flaw caused by improper input neutralization during web page generation. This allows an attacker with at least low privileges and requiring user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability to a limited extent. The vulnerability affects all versions up to 1.0 of the plugin. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure, session hijacking, or other client-side impacts. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, and user interaction needed, with partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting privileges of users who can submit content and apply web application firewall rules to detect and block XSS payloads relevant to this plugin.