CVE-2025-58683 describes a stored cross-site scripting vulnerability in the Last Updated Shortcode plugin by Luke Mlsna, present in versions up to 1.0.1. The issue is caused by improper neutralization of input during web page generation, enabling an attacker with limited privileges and requiring user interaction to execute arbitrary scripts in the context of the affected site. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided, and no known exploits have been reported.

The vulnerability allows stored cross-site scripting attacks, which can lead to limited compromise of confidentiality, integrity, and availability of the affected system. An attacker with low privileges and requiring user interaction could inject malicious scripts that execute in the context of other users, potentially leading to session hijacking, defacement, or other malicious actions. However, the impact is limited by the need for privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting access to the plugin functionality to trusted users only and be cautious with input that may be rendered by the plugin. Monitor official sources for updates and apply any official fixes promptly once released.