CVE-2025-46262 describes a stored cross-site scripting vulnerability in the Mad Mimi for WordPress plugin by Zack Katz. The issue is caused by improper neutralization of input during web page generation, which allows an attacker to inject malicious scripts that persist and execute when other users view the affected content. This vulnerability affects all versions up to 1.5.1. The CVSS score of 6.5 reflects a medium severity with potential impacts on confidentiality, integrity, and availability. No patch or official fix has been documented in the provided data, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing the affected WordPress pages, potentially leading to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, no known exploits in the wild have been reported, and the impact is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Mad Mimi plugin if feasible, or applying any temporary mitigations recommended by the vendor. Monitor official Zack Katz or WordPress plugin sources for updates regarding patches or workarounds.