CVE-2025-6686 is a stored cross-site scripting vulnerability in the Magic Buttons for Elementor WordPress plugin by rexdot. The flaw arises from improper neutralization of user input in the 'text' attribute of the magic-button shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of any user who views the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 1.0. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. This can lead to unauthorized actions performed in the context of other users viewing the page, such as theft of session tokens or defacement. The impact is limited to confidentiality and integrity, with no direct availability impact. Since the vulnerability requires authenticated access, the attack surface is somewhat limited but still significant in multi-user WordPress environments.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict contributor-level access and above to trusted users only. Avoid using the vulnerable shortcode until a fix is released. Review and sanitize any user-generated content that uses the magic-button shortcode. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.