The vulnerability CVE-2025-50016 affects the brijeshk89 IP Based Login plugin (versions ≤ 2.4.2). It is a stored cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability requires an attacker to have high privileges and user interaction to exploit, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and low impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to partial disclosure of information, modification of data, or disruption of service. The impact is limited by the requirement for high privileges and user interaction. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access and exercise caution with user input handling. Monitor vendor channels for updates regarding patches or mitigations.