The vulnerability CVE-2025-58826 affects the WP Publication Archive WordPress plugin by Eric Mann. It is a stored cross-site scripting (XSS) flaw caused by improper input sanitization during the generation of web pages. This allows an attacker with low privileges to inject malicious scripts that execute when a user views the affected content. The vulnerability impacts versions up to 3.0.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and impacts confidentiality, integrity, and availability at a low level with scope changed.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected site, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or disrupt site availability. The impact is rated medium with partial loss of confidentiality, integrity, and availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting privileges to trusted users and monitoring for suspicious activity related to the plugin. Avoid exposing the plugin to untrusted users where possible.