CVE-2025-9333 is a stored cross-site scripting vulnerability in the ibachal Smart Docs WordPress plugin affecting all versions up to 1.1.1. It arises from improper neutralization of input during web page generation, allowing authenticated administrators to inject arbitrary web scripts via the plugin's admin settings. This vulnerability only affects multi-site WordPress installations or installations with unfiltered_html disabled, due to insufficient input sanitization and output escaping in the plugin. The CVSS 3.1 base score is 5.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and low confidentiality and integrity impact without availability impact.

An authenticated attacker with administrator-level permissions can inject persistent malicious scripts into pages managed by the Smart Docs plugin. These scripts execute in the context of users who view the injected pages, potentially leading to session hijacking, privilege escalation, or other impacts related to cross-site scripting. The impact is limited to multi-site WordPress environments or those with unfiltered_html disabled. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should restrict access to the Smart Docs plugin settings to trusted users only and consider disabling or limiting the plugin in multi-site environments or where unfiltered_html is disabled. Monitoring vendor channels for updates and applying patches promptly when available is recommended.