The vulnerability CVE-2025-53238 involves improper neutralization of input in the Toast Plugins Toast Mobile Menu plugin, specifically versions up to 1.0.8. This flaw allows stored cross-site scripting (XSS) attacks, where malicious input is not properly sanitized before being rendered in web pages. The CVSS 3.1 base score is 7.1, reflecting a network attack vector with low attack complexity, no privileges required, but requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability with a scope change. No patch or official fix is currently documented.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to theft of user data, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS score of 7.1 indicates a high severity impact. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the Toast Mobile Menu plugin or applying any available temporary mitigations such as input validation or content security policies to reduce the risk of exploitation.