The vulnerability CVE-2025-30548 affects the Advanced Post Search plugin by VarDump s.r.l., specifically versions up to 1.1.0. It is a reflected cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that execute when a user interacts with crafted input, potentially compromising user data and session integrity. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability at a low level. No patch or official fix information is currently available.

Successful exploitation of this reflected XSS vulnerability can allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of user credentials, session hijacking, or other malicious actions. The impact is rated as high severity with limited confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should avoid using affected versions of Advanced Post Search or implement temporary mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates and apply patches promptly once released.