The vulnerability CVE-2025-48258 in jetmonsters Mega Menu Block (getwid-megamenu) allows stored cross-site scripting due to improper input neutralization during web page generation. This affects versions up to 1.0.6. The CVSS 3.1 base score is 6.5, indicating a medium severity issue with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users, potentially leading to information disclosure, modification of content, or disruption of service. The impact is limited to confidentiality, integrity, and availability with a medium severity rating. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user privileges to trusted users only and monitor for suspicious input or behavior related to the Mega Menu Block. Avoid enabling untrusted user input in menu content. Follow vendor channels for updates on patches or official mitigations.