CVE-2025-28875 is a stored cross-site scripting vulnerability in the BP Email Assign Templates plugin (version <= 1.6) by shanebp. The issue arises from improper neutralization of input during web page generation, allowing an attacker with high privileges and requiring user interaction to inject malicious scripts. The CVSS 3.1 base score is 5.9 (medium), with network attack vector, low attack complexity, and scope changed. The vulnerability impacts confidentiality, integrity, and availability at a low level. No patch or vendor advisory information is provided.

The vulnerability allows stored XSS, which can lead to limited compromise of confidentiality, integrity, and availability of the affected system. Exploitation requires high privileges and user interaction, reducing the likelihood of widespread impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high privilege access to the affected plugin and avoid interacting with untrusted input in the BP Email Assign Templates plugin. Monitor vendor channels for updates.