CVE-2025-48365 describes a stored cross-site scripting vulnerability in the imaprogrammer Custom Comment plugin (versions up to 2.1.6). This vulnerability is due to improper neutralization of input during web page generation, which allows an attacker with high privileges to inject malicious scripts that are stored and subsequently executed when other users view the affected content. The CVSS 3.1 score of 5.9 reflects a medium severity with network attack vector, low attack complexity, required privileges, and user interaction. There is no vendor advisory or patch information available, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users viewing the affected pages, potentially leading to limited confidentiality, integrity, and availability impacts. Because it is a stored XSS, the malicious payload persists and can affect multiple users. However, exploitation requires user interaction and high privileges, which limits the overall impact severity to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict high-privilege user access to the Custom Comment plugin and carefully validate and sanitize user inputs where possible to reduce risk. Monitor vendor channels for updates regarding patches or official mitigations.