The vulnerability CVE-2025-30600 in the WP Hotjar plugin (versions <= 0.0.3) involves improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). This allows an attacker with the ability to inject input to store malicious scripts that execute when viewed by users with high privileges. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability to a limited extent. No patch or vendor advisory is provided, and no known exploits are reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of privileged users, potentially leading to limited confidentiality, integrity, and availability impacts. The medium severity reflects that exploitation requires high privileges and user interaction, limiting the attack scope. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. Until a patch is available, avoid using affected versions or restrict access to trusted users only to reduce risk.