The vulnerability CVE-2025-32493 affects VibeThemes BP Social Connect plugin versions up to 1.6.2. It is a stored cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows attackers with high privileges to inject malicious scripts that execute when other users view the affected content. The CVSS score is 5.9 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation can result in execution of arbitrary scripts in the context of affected users, potentially leading to limited disclosure of information, modification of data, or disruption of service. The attack requires an attacker with high privileges to inject the payload and user interaction to trigger the script execution. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege user access to the plugin and avoid accepting untrusted input that could be stored and rendered. Monitor vendor channels for updates and apply patches promptly once available.