The WP Airdrop Manager plugin by kadesthemes contains a stored cross-site scripting vulnerability (CVE-2025-49053) due to improper input neutralization during web page generation. This flaw affects all versions up to 1.0.5 and allows attackers with high privileges to inject malicious scripts that execute when other users view the affected content. The vulnerability has a CVSS 3.1 score of 5.9, reflecting medium severity with potential impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided by the vendor, and no known exploits have been observed in the wild.

Successful exploitation can lead to execution of arbitrary scripts in the context of users viewing the affected pages, potentially resulting in limited confidentiality, integrity, and availability impacts. The attack requires high privileges and user interaction, limiting the scope of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin to trusted users with high privileges and avoid interacting with untrusted input that could be stored and rendered by the plugin. Monitor vendor channels for updates and apply patches promptly once released.