CVE-2025-25117 is a stored cross-site scripting vulnerability in Alex Polonski's Smart Countdown FX plugin (versions up to 1.5.5). It results from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that persist and execute when other users view the affected content. The vulnerability has a CVSS 3.1 base score of 6.5, with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time, and no known exploits have been reported.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing the affected pages, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS score of 6.5 reflects a medium severity level. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor for updates from Alex Polonski or the plugin distribution source. Until a fix is released, consider disabling or restricting use of the affected plugin to reduce exposure.