The WP Featured Content Slider plugin by IWEBIX contains a stored cross-site scripting vulnerability identified as CVE-2025-30634. This vulnerability results from improper input sanitization during web page generation, enabling attackers with high privileges and requiring user interaction to inject malicious scripts that persist on the site. The CVSS 3.1 base score is 5.9 (medium), reflecting network attack vector, low attack complexity, high privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. The affected versions include all versions up to 2.6.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the context of users visiting the affected site, potentially leading to limited disclosure of information, modification of content, or disruption of service. The impact is rated medium based on the CVSS score of 5.9. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege user access to trusted individuals and consider disabling or replacing the affected plugin to mitigate risk. Monitor vendor channels for updates regarding patches or official mitigations.