The vulnerability CVE-2025-25115 exists in the 'Like dislike plus counter' plugin, where input is not properly sanitized before being embedded in web pages. This allows an attacker to inject and store malicious scripts (Stored XSS), which can execute in the context of other users viewing the affected pages. The issue affects all versions up to 1.0. The CVSS vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users' browsers, potentially leading to theft of user credentials, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability to a limited extent. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin or applying manual input sanitization controls if feasible. Monitor vendor communications for updates regarding patches or official mitigations.