CVE-2025-47638 is a stored cross-site scripting vulnerability in the WP Discord Invite WordPress plugin (versions up to 2.5.3). It results from improper input neutralization during web page generation, enabling attackers with high privileges to inject malicious scripts that execute in the context of users who view the affected pages. The vulnerability has a CVSS 3.1 score of 5.9, reflecting medium severity with network attack vector, low attack complexity, required privileges, and user interaction. No patch or official vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation can lead to limited confidentiality, integrity, and availability impacts by executing malicious scripts in the context of users viewing the affected pages. The attacker must have high privileges and require user interaction to trigger the vulnerability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access to the plugin and limit user interactions with untrusted content. Monitor for updates from the vendor regarding patches or mitigations.