CVE-2025-4168 is a stored XSS vulnerability in the Subpage List plugin for WordPress, affecting all versions up to 1.3.3. The issue arises from insufficient input sanitization and output escaping of user-supplied attributes in the plugin's 'subpages' shortcode. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary scripts that execute in the context of users viewing the compromised pages. The vulnerability is network exploitable with low attack complexity and no user interaction required, impacting confidentiality and integrity but not availability.

Successful exploitation allows an authenticated contributor or higher to execute arbitrary scripts in the context of other users viewing the injected pages. This can lead to information disclosure or manipulation of page content. The vulnerability does not impact system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Subpage List plugin if possible. Monitor official vendor channels for updates and patches addressing this vulnerability.