CVE-2025-2483 is a reflected cross-site scripting vulnerability (CWE-79) in the bobcares_plugins Gift Certificate Creator WordPress plugin. The issue exists in the 'receip_address' parameter due to improper neutralization of input during web page generation, allowing injection of malicious scripts. This affects all versions up to and including 1.1.0. The vulnerability can be exploited by unauthenticated attackers who can trick users into clicking malicious links, causing script execution in the context of the affected site. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the vulnerable website for users who interact with crafted links. This can lead to limited confidentiality and integrity impacts such as session hijacking or content manipulation. There is no indication of availability impact. The vulnerability requires user interaction and does not require authentication.

Patch status is not yet confirmed — no official fix or patch links are provided. Users of the Gift Certificate Creator plugin should monitor the vendor's advisory channels for updates. Until a patch is available, consider disabling or removing the plugin if feasible, or applying custom input validation and output escaping as a temporary mitigation.