The vulnerability CVE-2025-48235 in WP Image Mask plugin is a DOM-based cross-site scripting flaw caused by improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that execute in the victim's browser context. The affected versions include all versions up to 3.1.2. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and partial impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The impact is limited by the requirement for user interaction and low privileges needed by the attacker. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure by restricting plugin usage to trusted users and monitoring for suspicious activity related to the plugin. Avoid clicking on untrusted links that could trigger the vulnerability. Follow vendor channels for updates on patches or official mitigations.