CVE-2025-30602 describes a stored cross-site scripting vulnerability in the alphasis 'Related Posts via Categories' plugin, versions up to 2.1.2. The issue is caused by improper neutralization of input during web page generation, which enables an attacker to inject malicious scripts that persist and execute in the context of users visiting affected pages. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts to confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability requires user interaction and can be exploited remotely without privileges. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or limiting use of the affected plugin to reduce exposure. Monitor official alphasis communications for updates and apply patches promptly once released.