CVE-2025-53330 describes a stored cross-site scripting vulnerability in the WP Rentals WordPress plugin by WpEstate, affecting all versions through 3.16.1. The issue is caused by improper input neutralization during web page generation, which can allow an attacker with limited privileges and requiring user interaction to execute arbitrary scripts in the context of the affected site. The vulnerability has a CVSS 3.1 score of 6.5, reflecting medium severity with impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available in the provided data. No known exploits have been reported in the wild. Since WP Rentals is not a cloud service, remediation requires applying vendor patches when released.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to inject and execute malicious scripts in the context of the affected website, potentially leading to partial compromise of confidentiality, integrity, and availability of the site and its users. The CVSS score of 6.5 indicates a medium severity impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided in the available data, users should monitor WpEstate's official channels for updates addressing this vulnerability. Until a patch is available, limiting user privileges and exercising caution with user-generated content may reduce risk.