The vulnerability CVE-2025-30776 affects webvitaly Sitekit (<= 1.8) and is classified as a stored cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. This flaw allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, required privileges, user interaction, and scope change with low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, session hijacking, or other impacts on user interaction with the Sitekit application. The impact is rated medium due to the limited scope and required conditions (low privileges and user interaction). There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider implementing additional input validation or output encoding as a temporary mitigation. Monitor vendor channels for updates regarding patches or official fixes.