CVE-2025-4666 is a stored cross-site scripting vulnerability in the Zotpress plugin for WordPress, affecting all versions up to and including 7.3.15. The vulnerability is due to improper neutralization of input in the 'nickname' parameter, allowing authenticated users with Author-level privileges or higher to inject arbitrary web scripts. These scripts execute when any user accesses the injected page, potentially compromising user sessions or data. The CVSS 3.1 base score is 6.4 (medium severity), with network attack vector, low attack complexity, privileges required at the Author level, no user interaction needed, and impacts on confidentiality and integrity but not availability.

An attacker with Author-level access or higher can exploit this vulnerability to inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to unauthorized actions or data disclosure limited to the confidentiality and integrity of user data within the WordPress environment. There is no indication of availability impact. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider applying additional input validation or output escaping controls if possible. Monitor vendor channels for updates regarding a security patch.