CVE-2025-6537 is a stored Cross-Site Scripting vulnerability in the Namasha By Mdesign WordPress plugin affecting all versions up to 1.2.00. The issue is due to improper neutralization of input during web page generation, specifically through the 'playicon_title' parameter. Authenticated attackers with Contributor-level privileges or higher can exploit this to inject arbitrary scripts that execute in the context of users viewing the compromised pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an attacker with Contributor-level access or above to inject persistent malicious scripts into pages, potentially leading to session hijacking, defacement, or other script-based attacks against users who view the injected content. The confidentiality and integrity of user data can be partially compromised, but there is no direct impact on availability.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Namasha By Mdesign plugin if possible to prevent exploitation.