CVE-2025-2510 is a stored cross-site scripting vulnerability in the Frndzk Expandable Bottom Bar plugin for WordPress, affecting all versions up to and including 1.0. The vulnerability arises from insufficient input sanitization and output escaping of the 'text' parameter, enabling authenticated administrators to inject arbitrary web scripts. This vulnerability is limited to multi-site WordPress installations or installations where the unfiltered_html capability is disabled, allowing persistent script injection that executes when users view the compromised pages.

An attacker with administrator-level permissions can exploit this vulnerability to inject malicious scripts that execute in the context of other users visiting the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or defacement, but does not affect availability. The vulnerability does not affect single-site installations or those with unfiltered_html enabled. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict administrator access to trusted users only and consider disabling or removing the Frndzk Expandable Bottom Bar plugin in multi-site environments or where unfiltered_html is disabled until a fix is released.