The vulnerability CVE-2025-23896 exists in the Mindmeister Shortcode plugin by thom4, where improper neutralization of input during web page generation allows DOM-based cross-site scripting (XSS). This issue affects versions up to 1.0. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No known exploits in the wild or vendor patches have been reported as of the published date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The CVSS vector indicates that the attacker requires low privileges and user interaction, and the impact is limited to partial compromise of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider restricting access to the vulnerable plugin or disabling it if feasible to mitigate risk.