The vulnerability CVE-2025-23878 affects the Scott Reilly Post-to-Post Links plugin (versions up to 4.2) and is classified as a stored cross-site scripting (XSS) issue. It arises from improper input neutralization during web page generation, allowing malicious script injection. The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, low attack complexity, required high privileges, required user interaction, and impacts on confidentiality, integrity, and availability. There is no indication of an official patch or vendor advisory addressing this issue.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject persistent malicious scripts into web pages generated by the plugin. This may lead to partial compromise of confidentiality, integrity, and availability of affected systems or data. However, exploitation requires user interaction and high privileges, limiting the ease of attack. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting high privilege access to trusted users only and consider disabling or removing the affected plugin if feasible.