CVE-2025-4221 is a stored cross-site scripting vulnerability in the baswaniyash Animated Buttons WordPress plugin (versions up to 1.0.0). It occurs due to improper neutralization of input during web page generation, specifically in the 'auto-downloader' shortcode. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript code via unsanitized shortcode attributes, which executes in the context of users viewing the compromised pages. This can lead to partial confidentiality and integrity impacts but does not affect availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, privileges required, no user interaction, scope change, and limited confidentiality and integrity impact.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. When other users access these pages, the injected scripts execute in their browsers, potentially leading to partial disclosure of information and modification of data within the affected site context. There is no impact on system availability. The vulnerability does not require user interaction beyond viewing the compromised page.

No official patch or fix is currently available for this vulnerability. Users should restrict contributor-level access to trusted individuals and consider disabling or removing the Animated Buttons plugin until a vendor-provided fix is released. Monitor the vendor's advisory channels for updates regarding remediation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.