The vulnerability CVE-2025-32135 involves improper neutralization of input in the Split Test For Elementor plugin, leading to stored cross-site scripting (XSS). This affects versions up to 1.8.4 and allows an attacker with high privileges and requiring user interaction to execute scripts in a context where the plugin generates web pages. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability at a low level.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that are stored and later executed in the context of users viewing the affected pages. This can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. However, exploitation requires user interaction and high privileges, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege user access to trusted personnel only and be cautious with user input handling in the plugin. Monitor vendor channels for updates or patches addressing this vulnerability.