CVE-2025-3432 is a stored cross-site scripting vulnerability in the elpix AAWP Obfuscator WordPress plugin affecting all versions up to and including 1.0. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'data-aawp-web' parameter. This allows authenticated users with Author-level or higher privileges to inject arbitrary web scripts that execute in the context of other users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4 (medium severity) with network attack vector, low attack complexity, privileges required at the Author level, no user interaction needed, and impacts confidentiality and integrity with no availability impact.

An attacker with Author-level or higher access can inject persistent malicious scripts into pages via the vulnerable parameter. These scripts execute in the browsers of users who view the injected pages, potentially compromising user sessions or data confidentiality and integrity. There is no known exploitation in the wild at this time. The impact is limited to users who access the injected content and requires attacker authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider removing or disabling the AAWP Obfuscator plugin if possible. Monitor for updates from the vendor elpix regarding patches or official mitigations.