The vulnerability CVE-2025-58870 affects the WP-GraphViz plugin by DeBAAT, specifically versions up to 1.5.1. It arises from improper neutralization of input during web page generation, leading to a DOM-based Cross-site Scripting (XSS) issue. The CVSS 3.1 base score is 6.5, indicating medium severity, with an attack vector of network, low attack complexity, requiring low privileges and user interaction, and impacts on confidentiality, integrity, and availability at a low level. No patch or official remediation information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser within the context of the vulnerable site. This may lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. The attack requires user interaction and low privileges, limiting its ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting plugin usage to trusted users only and monitor for updates from DeBAAT. Avoid clicking on suspicious links that could trigger the vulnerability. No official patch or workaround information is currently available.