CVE-2025-5233 is a stored cross-site scripting vulnerability (CWE-79) in the thatdevgirl Color Palette WordPress plugin affecting all versions up to 4.3.2. The vulnerability exists due to improper neutralization of input in the ‘hex’ parameter, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses the injected page, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

An authenticated attacker with Contributor-level or higher access can exploit this vulnerability to inject malicious scripts into pages generated by the plugin. This can lead to unauthorized script execution in the context of other users viewing the affected pages, potentially compromising user sessions or performing actions on behalf of those users. The vulnerability does not impact availability and has limited confidentiality and integrity impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Color Palette plugin if feasible. Monitor for updates from the vendor or security advisories for a patch or official mitigation.