CVE-2025-46447 describes a DOM-based cross-site scripting vulnerability in WPFable Fable Extra, affecting versions up to and including 1.0.6. The issue arises from improper neutralization of input during web page generation, which can lead to script injection in the DOM context. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, requiring privileges and user interaction, and resulting in partial confidentiality, integrity, and availability impacts. No patch or vendor advisory details are provided, and the product is not a cloud service.

Exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to partial compromise of confidentiality, integrity, and availability of the application or its data. The attack requires low complexity, some privileges, and user interaction. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider applying any available workarounds or input validation controls if feasible. Monitor vendor communications for updates on patches or official mitigations.