CVE-2025-57935 describes a stored cross-site scripting vulnerability in the Ricky Dawn Bot Block – Stop Spam Referrals in Google Analytics plugin (versions up to 2.6). The vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and later executed in users' browsers. The CVSS 3.1 base score is 5.9 with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No patch or official fix information is provided in the data.

An attacker with high privileges and requiring user interaction could exploit this vulnerability to execute stored malicious scripts within the context of the affected plugin. This could lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. There are no known exploits in the wild, and the impact is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, limit high privilege access to trusted users and be cautious with user input that may be processed by the plugin.