The vulnerability CVE-2025-49390 affects the christophrado Cookie Notice & Consent plugin (versions up to 1.6.4) and involves improper neutralization of input during web page generation, resulting in a Stored Cross-site Scripting (XSS) flaw. This allows attackers to inject malicious scripts that are stored and later executed in the context of users' browsers. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality, integrity, and availability impacts. No patch or official remediation guidance is currently available from the vendor or other sources. The vulnerability is published and known but not yet confirmed to be exploited in the wild.

Successful exploitation of this Stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of affected users' sessions or data within the context of the vulnerable web application. Attackers could execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or other malicious actions. However, the impact is limited to the scope of the affected web application and requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the use of the vulnerable plugin version. Monitor vendor channels for updates and apply patches promptly once available. No vendor advisory or patch links are currently provided.