CVE-2025-6689 is a stored cross-site scripting vulnerability in the armandofiore FL3R Accessibility Suite WordPress plugin, affecting all versions up to and including 1.4. The flaw arises from improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping of user-supplied attributes in the plugin's fl3raccessibilitysuite shortcode. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. This vulnerability is classified under CWE-79 and has a CVSS v3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

Successful exploitation allows an authenticated user with contributor or higher privileges to inject persistent malicious scripts into pages rendered by the plugin. These scripts execute in the browsers of users who view the infected pages, potentially leading to information disclosure and integrity impacts limited to the affected site. There is no direct availability impact. The vulnerability could facilitate actions such as session hijacking or unauthorized actions within the context of the victim's browser session.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates regarding a fix. Until a patch is released, restrict contributor-level access to trusted users only and consider disabling or removing the FL3R Accessibility Suite plugin if possible to mitigate risk.