CVE-2025-47522 describes a stored cross-site scripting vulnerability in the AWEOS WP Lock WordPress plugin up to version 1.4.8. The issue is caused by improper input neutralization during web page generation, which allows stored malicious scripts to be executed in the context of users who view the affected pages. The vulnerability requires network access, low attack complexity, high privileges, and user interaction. The CVSS 3.1 vector indicates partial impact on confidentiality, integrity, and availability. No patch or official remediation information is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker with high privileges and user interaction to execute arbitrary scripts in the context of affected users, potentially leading to limited confidentiality, integrity, and availability impacts. The medium CVSS score reflects these moderate risks. There are no known exploits in the wild, and the vulnerability affects only versions up to 1.4.8 of the AWEOS WP Lock plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and monitor for suspicious activity related to the plugin. Avoid interacting with untrusted input that could be stored and rendered by the plugin.