CVE-2025-9131 is a stored cross-site scripting vulnerability in the Ogulo – 360° Tour WordPress plugin affecting all versions up to 1.0.11. The issue stems from improper neutralization of input in the 'slug' parameter, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 6.4, reflecting medium impact on confidentiality and integrity with no impact on availability. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

Successful exploitation allows authenticated users with Contributor-level access or above to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who view the compromised pages, potentially leading to unauthorized actions such as session hijacking or data theft. The vulnerability affects confidentiality and integrity but does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Contributor-level access to trusted users only and consider disabling or removing the Ogulo – 360° Tour plugin if feasible. Monitor for plugin updates that address this vulnerability.