The vulnerability CVE-2025-53278 affects WPeka WP AdCenter (<= 2.6.0) and is classified as a stored cross-site scripting (XSS) flaw due to improper input neutralization during web page generation. Exploitation requires network access, low attack complexity, low privileges, and user interaction. Successful exploitation can result in a security context with scope change and limited impacts on confidentiality, integrity, and availability.

Exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The CVSS vector indicates that the attack requires user interaction and low privileges, limiting the ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor WPeka's official channels for updates. Until a fix is available, consider restricting access to the affected plugin or applying web application firewall (WAF) rules to detect and block potential XSS payloads.