The vulnerability CVE-2025-58665 affects the tmontg1 Form Generator for WordPress plugin, specifically versions up to 1.52. It is a Stored Cross-site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. An attacker with high privileges and requiring user interaction can exploit this to execute arbitrary scripts in the context of the affected site. The CVSS 3.1 base score is 5.9, indicating a medium severity with network attack vector, low attack complexity, and impacts on confidentiality, integrity, and availability.

Exploitation of this vulnerability can result in partial compromise of confidentiality, integrity, and availability of the affected WordPress site. Since it is a stored XSS, malicious scripts can persist and execute in users' browsers, potentially leading to session hijacking, defacement, or other malicious actions. However, exploitation requires high privileges and user interaction, which limits the ease of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege user access to trusted individuals only and consider disabling or removing the affected plugin if feasible. Monitor vendor channels for updates regarding patches or official mitigations.