The vulnerability CVE-2025-60099 in awsm.in Embed Any Document plugin allows stored cross-site scripting due to improper input neutralization during web page generation. This enables an attacker with low privileges and requiring user interaction to inject malicious scripts that execute in a context with shared security scope (scope changed). The CVSS vector indicates network attack vector, low attack complexity, partial impacts on confidentiality, integrity, and availability. The affected versions are up to 2.7.7. The product is cloud-hosted, and a patch is available.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. The attacker requires low privileges and user interaction to trigger the exploit. The vulnerability affects a cloud-hosted service, which may expose multiple users to risk if exploited.

A patch is available for this vulnerability. Since the product is a cloud-hosted service, the vendor typically manages remediation server-side. Users and administrators should verify with the vendor advisory that the patch has been applied or that the service has been updated to mitigate this issue. No additional user action is required if the vendor confirms mitigation.