The vulnerability CVE-2025-27352 affects the wumii team 无觅相关文章插件 (wumii-related-posts) plugin, versions up to 1.0.5.7. It is a Stored Cross-site Scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that are stored and later executed in the context of users visiting the affected web pages. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official fix information is provided, and no cloud service is involved.

Successful exploitation of this vulnerability can allow attackers to execute arbitrary scripts in the context of users visiting the affected plugin's web pages. This can lead to limited confidentiality breaches (such as theft of cookies or session tokens), integrity issues (such as content manipulation), and availability impacts (such as browser crashes or denial of service). The CVSS score reflects these impacts as low confidentiality, integrity, and availability impacts. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor the vendor's communications for updates. In the meantime, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin. Avoid using the affected plugin version if possible until a fix is released.