CVE-2025-5842 is a stored cross-site scripting vulnerability in the butterflymedia Modern Design Library WordPress plugin. The issue occurs due to improper neutralization of input in the ‘class’ parameter, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute when any user accesses the compromised page, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to and including 1.1.4. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable ‘class’ parameter. This can lead to unauthorized script execution in the context of other users viewing the page, potentially compromising user sessions or data confidentiality and integrity. There is no indication of impact to availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider removing or disabling the Modern Design Library plugin if feasible. Monitor for updates from butterflymedia regarding a security patch.