CVE-2025-49409 is a Stored Cross-site Scripting (CWE-79) vulnerability in brewlabs SensorPress (up to version 1.0) caused by improper input neutralization during web page generation. This flaw permits attackers to inject malicious scripts that persist on the affected web application, potentially leading to full compromise of user sessions, data theft, or other malicious actions. The vulnerability is remotely exploitable without authentication and has a critical CVSS score of 9.8. No vendor patch or mitigation details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of the affected web application, leading to complete compromise of user confidentiality, integrity, and availability. This includes theft of sensitive information, session hijacking, and potential further attacks on users or the application. The CVSS score of 9.8 reflects the critical severity and ease of exploitation without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted content on SensorPress and consider implementing web application firewall (WAF) rules to detect and block potential XSS payloads. Monitor vendor channels for updates regarding patches or official mitigations.