The vulnerability CVE-2025-60142 affects the Simple Meta Tags plugin by DaganLev, where insufficient input sanitization during web page generation leads to a DOM-based XSS issue. This allows an attacker to inject and execute arbitrary scripts in the victim's browser, potentially compromising user data and session integrity. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges at the low level, user interaction needed, and impacts on confidentiality, integrity, and availability. The affected versions include all versions up to 1.5. No patch or official fix has been documented yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, exploitation requires user interaction and low-level privileges, which somewhat limits the attack scope. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure by restricting privileges where possible and educating users about the risks of interacting with untrusted content. Monitor vendor channels for updates regarding patches or official mitigations.