CVE-2025-48080 is a stored cross-site scripting vulnerability in the Uncanny Owl Uncanny Toolkit for LearnDash plugin (versions up to 3.7.0.2). The issue is caused by improper neutralization of input during web page generation, which allows an attacker with limited privileges to inject malicious scripts that persist and execute in other users' browsers. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity), with attack vector network, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability. No patch or vendor advisory detailing remediation is currently available.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, modification of data, or disruption of service. The impact affects confidentiality, integrity, and availability to a limited extent as per the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting privileges to trusted users and monitor for suspicious activity related to script injection. Avoid granting unnecessary privileges to users who can input data that is rendered on web pages. Follow vendor channels for updates on patches or official mitigations.