CVE-2025-30937 describes a stored cross-site scripting vulnerability in the Responsify WP plugin (versions <= 1.9.11) by stefanledin. The issue is caused by improper neutralization of input during web page generation, which allows an attacker to inject and store malicious scripts that execute when viewed by users with high privileges. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting network attack vector, low attack complexity, required privileges, and user interaction. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of privileged users, potentially leading to limited confidentiality, integrity, and availability impacts. The attack requires the attacker to have high privileges and user interaction, which reduces the overall risk. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin and limiting privileges to trusted users. Monitor for updates from the vendor or security advisories for patches or workarounds.