CVE-2025-30991 describes a stored cross-site scripting vulnerability in the Shahjada WPDM – Premium Packages WordPress plugin (versions up to 6.0.6). The issue is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and later executed in users' browsers. The vulnerability requires low privileges and user interaction and has a CVSS 3.1 base score of 6.5, reflecting medium severity with impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available, and no known exploitation in the wild has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial compromise of user data confidentiality, integrity, and availability. The attack requires user interaction and low privileges, limiting the scope but still posing a risk to users interacting with the vulnerable plugin's interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin or restricting access to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.