CVE-2025-30527 describes a stored cross-site scripting vulnerability in codetoolbox's My Bootstrap Menu (versions up to 1.2.1). This vulnerability results from improper input neutralization during web page generation, which can allow an attacker with high privileges and requiring user interaction to inject malicious scripts that affect confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change. No patch or vendor advisory information is provided.

The vulnerability allows stored XSS attacks that can lead to limited confidentiality, integrity, and availability impacts. An attacker with high privileges and requiring user interaction could exploit this to execute malicious scripts in the context of other users. No known exploits are reported, and the impact is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting high-privilege user input and applying web application firewall (WAF) rules to detect and block XSS payloads if feasible.