CVE-2025-49875 describes a stored cross-site scripting vulnerability in the If-So Dynamic Content Personalization plugin, affecting versions up to 1.9.3.1. The issue is due to improper input neutralization during web page generation, which can allow attackers with limited privileges to inject malicious scripts that persist and execute in other users' browsers. The vulnerability has a CVSS 3.1 score of 6.5, reflecting a medium risk with potential impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no exploits have been observed in the wild. The product is not cloud-hosted, so remediation requires applying vendor patches once released.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to inject and store malicious scripts that execute in the context of other users' browsers. This can lead to partial compromise of confidentiality, integrity, and availability of affected systems or user data. However, the impact is rated medium, and no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input sources and consider applying any recommended temporary mitigations from the vendor. Monitor official If-So Dynamic Content advisories for updates.