The vulnerability CVE-2025-27305 affects the Achal Jain Table of Contents Block plugin (versions up to 1.0.2). It is a stored cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows an attacker with low privileges and requiring user interaction to inject malicious scripts that persist in the application, potentially affecting confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 6.5, indicating a medium severity level. No patch or official remediation guidance is currently provided by the vendor.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected application or user sessions. The attacker could execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions. However, exploitation requires user interaction and low privileges, limiting the scope somewhat. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected Table of Contents Block plugin version. Employing web application firewalls (WAFs) that detect and block XSS payloads may provide temporary mitigation. Monitor vendor channels for updates and apply patches promptly once available.