The vulnerability CVE-2025-24620 affects the AIO Shortcodes plugin by hkharpreetkumar1, specifically versions up to 1.3. It is a stored cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. The CVSS 3.1 base score is 7.1, indicating high severity, with an attack vector of network, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes low confidentiality, integrity, and availability impacts. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts that are stored and executed in the context of users visiting affected pages. This can lead to partial compromise of user data confidentiality, integrity, and availability. The vulnerability requires user interaction and can be exploited remotely without authentication. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting or sanitizing user input where possible and limiting exposure of the affected plugin. Monitor official sources for updates or patches from the vendor.