CVE-2025-8399 is a stored cross-site scripting vulnerability (CWE-79) in the Mmm Unity Loader WordPress plugin affecting all versions up to 1.0. The flaw allows authenticated users with Contributor-level privileges or above to inject arbitrary web scripts via the 'attributes' parameter due to improper input neutralization during web page generation. This can lead to script execution in the context of other users viewing the injected content. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This may lead to theft of user credentials, session hijacking, or other malicious actions limited to the scope of the injected script. There is no indication of impact on availability. The vulnerability does not appear to be exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Mmm Unity Loader plugin if feasible. Monitor for updates from the vendor regarding patches or official mitigations.