CVE-2025-5240 is a stored cross-site scripting vulnerability in the CRM and Lead Management by vcita WordPress plugin (versions up to 2.7.5). The issue occurs due to improper neutralization of input in the 'type' parameter, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of other users who access the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject malicious scripts that execute in other users' browsers when they view the compromised pages. This can lead to unauthorized actions performed in the context of the victim user, such as theft of session tokens or other sensitive information. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider monitoring or reviewing input handling related to the 'type' parameter. Avoid exposing affected pages to untrusted users. Follow vendor updates closely for an official patch or mitigation instructions.