The vulnerability CVE-2025-58653 affects the JS Morisset JSM file_get_contents() Shortcode plugin (up to version 2.7.1). It is a stored cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. This flaw allows an attacker with low privileges and requiring user interaction to inject malicious scripts, potentially impacting confidentiality, integrity, and availability of affected systems. The CVSS 3.1 base score is 6.5, with network attack vector, low attack complexity, privileges required, user interaction required, and scope changed.

Successful exploitation can lead to stored XSS attacks, which may allow attackers to execute arbitrary scripts in the context of the affected web application. This can result in partial loss of confidentiality, integrity, and availability. The vulnerability requires low privileges and user interaction, increasing the risk in environments where users might be tricked into triggering the exploit. There are no reports of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected shortcode functionality and applying input validation or sanitization at the application level if possible. Monitor vendor channels for updates and apply patches promptly once available.