CVE-2025-47615 describes a stored cross-site scripting vulnerability in the flowdee Amazon Product in a Post WordPress plugin, versions up to 5.2.2. The issue is caused by improper neutralization of input during web page generation, which allows attackers with high privileges to inject malicious scripts that are stored and later executed when other users view the affected content. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with limited impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute in the browsers of users who view the compromised posts. This can lead to limited confidentiality, integrity, and availability impacts such as session hijacking, defacement, or other script-based attacks. However, exploitation requires both high privileges and user interaction, reducing the overall risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access to trusted individuals only and consider disabling or limiting the use of the affected plugin to reduce risk. Monitor for vendor updates regarding patches or official mitigations.