CVE-2025-8314 is a stored cross-site scripting vulnerability (CWE-79) in the emarket-design Software Issue Manager WordPress plugin, affecting all versions up to 5.0.1. The issue stems from improper neutralization of input in the 'noaccess_msg' parameter, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability requires low attack complexity and no user interaction beyond accessing the injected page. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the low level, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject persistent malicious scripts into pages viewed by other users. This can lead to unauthorized actions performed in the context of other users, disclosure of sensitive information, or session hijacking. The impact affects confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the 'noaccess_msg' parameter if possible. Monitor for plugin updates from emarket-design and apply them promptly once released.