CVE-2025-8391 is a stored cross-site scripting vulnerability in the Magic Edge – Lite WordPress plugin by awssoft affecting all versions up to 1.1.6. The vulnerability is due to improper neutralization of input in the 'height' parameter, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary scripts. These scripts execute in the context of users who visit the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity but not availability. No known exploits in the wild have been reported. A patch is available to remediate this issue.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to partial confidentiality and integrity impacts, such as theft of user data or unauthorized actions performed on behalf of users. There is no impact on system availability. No known active exploitation has been reported.

A patch is available for this vulnerability. Users of the Magic Edge – Lite plugin should update to the latest version beyond 1.1.6 to remediate the stored XSS issue. Applying the official patch is the recommended mitigation. No additional vendor advisory details are provided, so check the vendor’s official channels for the latest patch and update instructions.