The vulnerability CVE-2025-49413 in highwarden Super Store Finder (<= 7.6) is a reflected Cross-site Scripting (XSS) issue caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute when a user interacts with a crafted link or input, potentially leading to partial compromise of user data confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability affects the plugin in its self-hosted form and is not a cloud service. No patch or official fix details are provided in the available data.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser session when they interact with maliciously crafted input or links. This can lead to limited confidentiality, integrity, and availability impacts, such as theft of user session data or manipulation of displayed content. However, the attack requires user interaction and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input or links related to the Super Store Finder plugin. Monitoring vendor channels for updates is recommended.