The vulnerability CVE-2025-62119 in the Add Featured Image Custom Link plugin involves improper neutralization of input during web page generation, resulting in a DOM-based cross-site scripting (XSS) issue. This allows an attacker with high privileges and requiring user interaction to execute malicious scripts in the context of the affected web application. The flaw affects all versions up to 2.0.0 of the plugin. The CVSS 3.1 base score is 5.9, indicating a medium severity level with impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of the affected system due to execution of arbitrary scripts in the user's browser context. The attack requires high privileges and user interaction, limiting the ease of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from ViitorCloud Technologies Pvt Ltd. Until a fix is available, limit exposure by restricting high privilege user actions that involve this plugin and avoid interacting with untrusted input related to the affected functionality.