CVE-2025-32211: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Broadstreet WordPress plugin, identified as CVE-2025-32211. The vulnerability affects versions through 1.51.2 and allows authenticated users with Subscriber-level privileges or higher to inject malicious scripts into web pages (Patchstack, NVD).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79). It has received a CVSS v3.1 score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility, low attack complexity, and required user interaction (Patchstack).

When exploited, this vulnerability allows attackers to inject malicious scripts that can execute when users visit the affected pages. These scripts could potentially be used to redirect users, inject unwanted advertisements, or execute other malicious HTML payloads in the context of the visiting user's browser (Patchstack).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. The attack complexity is considered low, making it relatively straightforward to exploit once the attacker has the necessary access privileges (Patchstack).

While no official fix is currently available, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until an official fix becomes available. Site administrators are advised to implement these mitigations immediately (Patchstack).