The Personizely plugin for WordPress suffers from a stored XSS vulnerability due to insufficient input sanitization and output escaping of the 'widgetId' parameter in versions up to 0.10. Authenticated users with Contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. This vulnerability is tracked as CVE-2025-3779 and has a CVSS 3.1 base score of 6.4, reflecting a medium severity level with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality and integrity but not availability.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject persistent malicious scripts into pages served by the Personizely plugin. This can lead to unauthorized actions performed in the context of other users, potentially compromising user data confidentiality and integrity. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the Personizely plugin. Avoid using the affected versions if possible.