CVE-2025-5533 is a stored cross-site scripting vulnerability in the ajay Knowledge Base WordPress plugin affecting all versions up to 2.3.0. The issue stems from improper neutralization of input in the 'kbalert' shortcode, where user-supplied attributes are not properly sanitized or escaped. Authenticated users with contributor-level permissions or higher can exploit this to inject arbitrary JavaScript that executes in the context of other users viewing the injected pages. This can lead to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with network attack vector, low attack complexity, privileges required, no user interaction, and impacts confidentiality and integrity with no impact on availability.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the compromised pages, potentially leading to theft of sensitive information or unauthorized actions performed on behalf of the victim. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a patch is available, restrict contributor-level access to trusted users only and consider disabling or removing the 'kbalert' shortcode or the Knowledge Base plugin if feasible to reduce exposure.