The vulnerability identified as CVE-2025-58630 affects rbaer Simple Matomo Tracking Code versions up to 1.1.0. It is a stored cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation. This flaw allows an attacker with high privileges to inject malicious scripts that are stored and later executed in the context of other users who view the affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges are high, user interaction is required, and the scope is changed, with limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the browsers of users who view the affected pages. This can lead to limited disclosure of information, modification of data, and disruption of service. However, exploitation requires user interaction and high privileges, which reduces the overall risk. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access to trusted individuals only and consider implementing web application firewall (WAF) rules to detect and block suspicious input patterns related to XSS. Monitor for updates from the vendor regarding patches or official mitigations.