The vulnerability CVE-2025-62991 affects the thinkupthemes Minamaze WordPress theme (versions up to 1.10.1) and is classified as a stored cross-site scripting (XSS) issue. It results from improper input sanitization during web page generation, enabling attackers with low privileges and requiring user interaction to inject malicious scripts that can compromise confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, and user interaction needed, with a scope change and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to information disclosure, session hijacking, or other impacts on user data and site integrity. The impact is rated as medium severity with limited confidentiality, integrity, and availability impacts. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor thinkupthemes' official channels for updates. Until a fix is available, consider applying temporary mitigations such as input validation or disabling vulnerable features if feasible.