CVE-2025-61872 is a cross-site scripting (XSS) vulnerability affecting Mahara before versions 25.04.2 and 24.04.11. The issue arises in the 'search site' feature when the Elasticsearch7 search plugin is used. The Elasticsearch function fails to properly sanitize user input in the query parameter, which can lead to the display of malicious script code. This vulnerability could allow an attacker to inject and execute arbitrary scripts in the context of the affected application’s users.

Successful exploitation of this vulnerability could enable an attacker to execute arbitrary scripts in the context of the affected users, potentially leading to session hijacking, defacement, or other client-side attacks. However, there are no reports of active exploitation in the wild. The impact is limited to users interacting with the vulnerable search feature using the Elasticsearch7 plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Elasticsearch7 search plugin or restricting access to the search functionality to trusted users to reduce exposure. Monitor vendor channels for updates regarding patches or official mitigations.