The vulnerability identified as CVE-2025-47621 affects Meks Flexible Shortcodes through version 1.3.6. It is a stored cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. This flaw allows attackers with at least low privileges and requiring user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and partial impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing the affected web pages. This may lead to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium based on the CVSS score of 6.5. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting privileges and limiting user interactions with untrusted content in the affected plugin. Monitor vendor channels for updates and apply patches promptly once released.