CVE-2025-62140 describes a stored cross-site scripting vulnerability in plainware Locatoraid Store Locator (<= 3.9.68). The vulnerability is due to improper input neutralization during web page generation, enabling attackers with high privileges to inject malicious scripts that execute when other users view the affected pages. The CVSS 3.1 base score is 5.9, reflecting network attack vector, low attack complexity, required privileges, required user interaction, and partial impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided.

Successful exploitation allows an attacker with high privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium with partial confidentiality, integrity, and availability impacts. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access to trusted users only and apply input validation or output encoding controls where possible to mitigate stored XSS risks.