CVE-2025-7966 is a stored cross-site scripting vulnerability in the Get Youtube Subs WordPress plugin by zohaib167. It affects all versions up to and including 3.5. The vulnerability allows authenticated users with Contributor or higher privileges to inject arbitrary web scripts through the 'channel', 'layout', and 'subs_count' parameters due to improper input sanitization and output escaping. These scripts execute when other users access the injected pages, potentially compromising user data or session integrity. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, requiring privileges, no user interaction, scope change, and limited confidentiality and integrity impact without availability impact.

Successful exploitation allows authenticated contributors or higher to inject and store malicious scripts that execute in the context of other users viewing the affected pages. This can lead to partial confidentiality and integrity loss, such as session hijacking or unauthorized actions performed by victim users. There is no reported impact on availability. No known exploits in the wild have been documented.

No official patch or fix is currently available for this vulnerability. Users should restrict Contributor-level access and above to trusted individuals only to reduce risk. Monitor vendor advisories for updates or patches addressing this issue. Implementing additional web application firewall (WAF) rules to detect and block suspicious input patterns related to the affected parameters may provide temporary mitigation.