The vulnerability CVE-2025-69089 in autolistings Auto Listings plugin allows stored cross-site scripting due to improper input neutralization during web page generation. This enables an attacker with low privileges to inject malicious scripts that execute when a user views the affected page. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and impacts confidentiality, integrity, and availability to a limited extent. The affected versions include all versions up to 2.7.1.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially compromising user data confidentiality, integrity, and availability. The impact is rated medium, reflecting limited but meaningful risk due to the requirement of user interaction and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting user input or applying web application firewall rules to detect and block malicious payloads related to stored XSS in the Auto Listings plugin.