CVE-2025-58223 describes a stored cross-site scripting vulnerability in Chris Taylor's VoucherPress plugin (versions up to 1.5.7). The issue is caused by improper neutralization of input during web page generation, which allows attackers with high privileges to inject malicious scripts that persist and execute when viewed by other users. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting network attack vector, low attack complexity, required high privileges, required user interaction, and impacts on confidentiality, integrity, and availability at a low level. No patch or official remediation guidance is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject and store malicious scripts within the VoucherPress plugin interface. When other users interact with the affected pages, these scripts could execute, potentially leading to limited disclosure of information, modification of data, or disruption of service. However, the requirement for high privileges and user interaction reduces the overall risk. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to high-privilege accounts and exercise caution with user input handling in VoucherPress. Monitor for updates from the vendor or trusted security sources to apply patches promptly once available.