CVE-2025-47500 is a stored cross-site scripting vulnerability in the Benjamin Intal Stackable WordPress plugin (versions up to 3.19.5). It results from improper input neutralization during web page generation, enabling attackers with high privileges and requiring user interaction to execute malicious scripts in a context where the plugin is used. The vulnerability has a CVSS 3.1 base score of 5.9 (medium severity), with attack vector network, low attack complexity, privileges required high, user interaction required, and impacts on confidentiality, integrity, and availability rated low to low-medium. No patch or vendor advisory information is provided, and no known active exploitation is reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject and execute malicious scripts in the context of the affected web application, potentially leading to limited confidentiality, integrity, and availability impacts. Since it is a stored XSS, the malicious payload could persist and affect users who view the compromised content. However, exploitation requires user interaction and high privileges, which limits the attack scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict high-privilege access to trusted individuals and consider disabling or limiting the use of the affected Stackable plugin versions. Monitor the vendor's communications for updates on patches or official mitigations.