The vulnerability CVE-2025-60157 in emarket-design's WP Ticket Customer Service Software & Support Ticket System is a stored cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. This allows an attacker with limited privileges to inject malicious scripts that persist and execute in the browsers of other users interacting with the system. The affected versions include all releases up to 6.0.2. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability. There is no cloud service involved, and no patch or mitigation details have been provided by the vendor yet.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to unauthorized disclosure of information, modification of data, or disruption of service within the affected WP Ticket system. The impact is rated medium based on the CVSS score of 6.5, with partial loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict privileges to trusted users only and consider implementing web application firewall (WAF) rules to detect and block suspicious input patterns related to XSS. Avoid exposing the vulnerable versions in untrusted environments and monitor for any updates from the vendor.