The vulnerability CVE-2025-30792 exists in the ufukart Comment Approved Notifier Extended plugin (versions up to 5.2) and involves improper neutralization of input during web page generation, resulting in a Stored Cross-site Scripting (XSS) flaw. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring high privileges and user interaction, with impacts on confidentiality, integrity, and availability at a low level. This vulnerability could allow an attacker with appropriate privileges to inject malicious scripts that persist and execute in the context of users viewing affected pages.

Exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. However, the attack requires user interaction and elevated privileges, limiting the scope and ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or advisory is provided, users should monitor for updates from the vendor. Until a fix is available, restricting high privilege user access and exercising caution with user-generated content may reduce risk.