This vulnerability (CVE-2025-27346) in the gerrygooner Rebuild Permalinks plugin is a reflected cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. It affects versions up to 1.6. The flaw allows attackers to inject malicious scripts that are reflected back to users, potentially compromising user sessions or data. There is no CVSS score or vendor advisory available, and no known exploits have been reported. The plugin is not cloud-hosted, so remediation requires patching by the vendor or users once a fix is available.

The vulnerability enables reflected XSS attacks, which can allow attackers to execute arbitrary scripts in users' browsers when they visit a crafted URL. This can lead to session hijacking, defacement, or other client-side impacts. No known exploits in the wild have been reported. The lack of a patch or official fix means the risk remains until addressed by the vendor.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or restricting access to the affected plugin to mitigate risk. Monitor official vendor channels for updates and apply any released fixes promptly.