CVE-2025-61872 is a reflected XSS vulnerability in Mahara's Elasticsearch7 search plugin affecting versions prior to 25.04.2 and 24.04.11. The issue arises because the Elasticsearch function does not properly sanitize user input in the query parameter of the 'search site' feature, allowing attackers to inject malicious scripts that are executed in the context of the victim's browser. The vulnerability has a CVSS 3.1 base score of 6.1 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality and integrity impacts.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser session when they perform a search using the vulnerable Elasticsearch7 plugin. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of displayed content. There is no impact on system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor for updates from Mahara and apply any released patches promptly. Until a fix is available, consider restricting or sanitizing user input to the search feature if feasible or disabling the Elasticsearch7 search plugin to mitigate risk.