The vulnerability CVE-2025-30551 in smartredfox Pretty file links (versions up to 0.9) is a stored cross-site scripting issue caused by improper input neutralization during web page generation. This flaw allows attackers with low privileges to inject malicious scripts that execute in the context of other users, potentially leading to limited compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on system security properties. No patch or official remediation information is provided, and no known exploits have been reported.

Successful exploitation can lead to stored XSS attacks, enabling attackers to execute arbitrary scripts in the browsers of users who view the affected content. This can result in limited disclosure of information, modification of data, and disruption of availability. The CVSS score of 6.5 indicates a medium severity impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the affected Pretty file links plugin versions. Implementing web application firewalls or input sanitization measures may help mitigate risk but are not substitutes for an official patch.