The vulnerability CVE-2025-32190 affects the Musician's Pack For Elementor plugin by smartwpress. It is a DOM-based Cross-site Scripting issue caused by improper input neutralization during web page generation. This allows attackers with at least low privileges and requiring user interaction to execute arbitrary scripts, potentially impacting confidentiality, integrity, and availability to a limited extent. The vulnerability affects versions up to 1.8.7. No patch or official remediation information is currently provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). However, exploitation requires user interaction and low privileges, which somewhat limits the risk. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider disabling or limiting use of the affected plugin version. Monitor the vendor's channels for updates or patches addressing this vulnerability.