The vulnerability CVE-2025-58974 in StellarWP WPComplete plugin is a stored cross-site scripting issue caused by improper input neutralization during web page generation. It affects all versions up to 2.9.5.2. The flaw allows attackers with some privileges to inject malicious scripts that execute in the context of other users, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS score of 6.5 reflects a medium severity with network attack vector, low complexity, but requiring privileges and user interaction. No patch or official vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker with some privileges to inject and store malicious scripts that execute when other users view affected pages. This may lead to partial disclosure of information, modification of data, or disruption of service. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as per the CVSS vector. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit user privileges to trusted users only and avoid exposing vulnerable plugin features to untrusted users. Monitor official StellarWP communications for updates and apply patches promptly once released.