The vulnerability CVE-2025-48354 affects the 'Better Post & Filter Widgets for Elementor' WordPress plugin by WP Smart Widgets. It is a stored cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. This allows attackers with at least low privileges and requiring user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability to a limited extent. The vulnerability affects all versions up to 1.6.1. No patch or vendor advisory has been provided yet.

Successful exploitation of this stored XSS vulnerability can lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). Attackers could inject malicious scripts that execute in the context of other users, potentially leading to session hijacking, defacement, or other malicious actions within the scope of the affected plugin. However, exploitation requires user interaction and some privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting plugin usage or applying temporary mitigations such as input sanitization or disabling the affected plugin. Monitor official WP Smart Widgets communications for updates.