CVE-2025-60136 describes a stored cross-site scripting vulnerability in the cartpauj User Notes plugin (versions up to 1.0.2). The issue is caused by improper neutralization of input during web page generation, which allows an attacker to inject malicious scripts that are stored and later executed when viewed by users. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting network attack vector, low attack complexity, high privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation information is provided in the available data, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject and store malicious scripts in user notes, which execute when viewed by other users. This can lead to limited confidentiality, integrity, and availability impacts, such as unauthorized actions performed in the context of the victim user. However, exploitation requires user interaction and high privileges, reducing the likelihood and scope of impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit user privileges to trusted users only and exercise caution when interacting with user-generated content in the User Notes plugin. Monitor vendor channels for updates and apply patches promptly once released.