The vulnerability CVE-2025-58008 affects the Participants Database plugin by xnau webdesign, allowing stored cross-site scripting due to improper input neutralization during web page generation. This can enable an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of affected users, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability is present in versions up to 2.7.6.3. No patch or official remediation guidance is currently provided.

Successful exploitation of this stored XSS vulnerability could allow attackers to execute arbitrary scripts in the context of users viewing the affected pages, potentially leading to partial compromise of user data confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change. However, no known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting user input that can be stored and rendered, and apply web application firewall rules to detect and block potential XSS payloads. Monitor official xnau webdesign communications for updates and apply patches promptly once available.