CVE-2025-58241 describes a DOM-based Cross-site Scripting vulnerability in the SnapWidget Social Photo Feed Widget (snapwidget-wp-instagram-widget) affecting versions up to 1.1.0. The vulnerability is due to improper neutralization of input during web page generation, which can lead to execution of malicious scripts in the user's browser. The CVSS 3.1 score of 6.5 reflects a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No patch or official remediation information is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. This could result in unauthorized actions performed on behalf of the user or disclosure of sensitive information accessible within the browser context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure by restricting privileges and user interactions where possible. Monitor vendor communications for updates and apply patches promptly once released.