CVE-2025-5536 is a stored cross-site scripting vulnerability in the Freemind Viewer WordPress plugin (versions up to 1.0). The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of attributes passed to the 'freemind' shortcode. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary JavaScript that executes in the context of users viewing the compromised page. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users viewing the page, potentially exposing sensitive information or altering page content. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Freemind Viewer plugin if possible. Monitor for updates from the vendor or plugin author regarding patches or mitigations.