The vulnerability CVE-2025-26904 affects the WP Responsive Auto Fit Text plugin for WordPress, specifically versions up to 0.2. It is a DOM-based cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. An attacker with low privileges and requiring user interaction can exploit this vulnerability remotely to cause partial impacts on confidentiality, integrity, and availability of the affected system. The CVSS score is 6.5, indicating a medium severity level. No patch or official remediation information is currently available.

Exploitation of this DOM-based XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected WordPress site. The attacker requires low privileges and user interaction to exploit the issue remotely. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider limiting exposure by restricting plugin usage or disabling it if feasible. Monitor for updates from the vendor or security advisories to apply patches once available.