The vulnerability CVE-2025-50013 in Jason Judge CSV Importer Improved is a stored cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. This allows an attacker with high privileges to inject malicious scripts that are stored and later executed when viewed by other users. The affected versions include all releases up to 0.6.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with limited impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject and store malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and high privileges, reducing the overall risk. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit high privilege access to the CSV Importer Improved plugin and exercise caution when importing CSV files from untrusted sources. Monitor vendor channels for updates regarding patches or mitigations.