The vulnerability CVE-2025-47578 affects the BNS Twitter Follow Button plugin developed by Edward Caissie. It is a DOM-based Cross-site Scripting (XSS) issue caused by improper neutralization of input during web page generation. This flaw exists in versions up to 0.3.8 and can be exploited remotely with low attack complexity but requires some user interaction. The vulnerability allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially impacting confidentiality, integrity, and availability.

Successful exploitation of this DOM-based XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges and user interaction, and combined partial impacts on confidentiality, integrity, and availability.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or removing the affected plugin version to mitigate risk.