The vulnerability CVE-2025-50022 affects the WP-FB-AutoConnect plugin for WordPress, specifically versions up to 4.6.4. It is a stored cross-site scripting (XSS) issue caused by improper input sanitization during web page generation. An attacker with high privileges and requiring user interaction can exploit this to execute arbitrary scripts in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, and user interaction needed, with a scope change.

Successful exploitation can lead to execution of malicious scripts in the context of other users, potentially allowing theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability to a limited extent. The attack requires high privileges and user interaction, which reduces the overall risk. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and carefully validate and sanitize inputs where possible. Monitor for updates from the vendor regarding patches or official mitigations.