This vulnerability (CVE-2025-62983) involves improper input neutralization in the Posts By Tag plugin by Sudar Muthu, leading to stored cross-site scripting (XSS). The issue affects versions up to 3.2.1 and allows an attacker with some privileges to inject malicious scripts that persist and execute in other users' browsers. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and partial impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The vulnerability requires some level of privilege and user interaction, which limits the ease of exploitation. The medium CVSS score reflects these factors. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should limit privileges to trusted users and consider disabling or restricting the use of the Posts By Tag plugin if feasible. Monitor official Sudar Muthu channels for updates and apply patches promptly once released.