The vulnerability CVE-2025-28908 in pipdig's pipDisqus plugin allows stored cross-site scripting due to improper input neutralization during web page generation. This affects versions up to 1.6. The CVSS vector indicates the attack requires network access, low attack complexity, high privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low and low respectively. No official patch or mitigation details are available from the vendor or other sources at this time.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that are stored and executed in the context of users viewing affected pages, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and high privileges, which reduces the overall risk. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit high privilege access and be cautious with user-generated content. Monitor vendor communications for updates on patches or official mitigations.