This vulnerability (CVE-2025-0609) in Logo Cloud involves improper neutralization of input during web page generation, classified under CWE-79 (Cross-Site Scripting). It affects versions before 1.18 and allows an attacker with high privileges to perform XSS attacks without user interaction. The CVSS 3.1 base score is 4.7 (medium), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. No patch or vendor advisory is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

Exploitation of this vulnerability could allow an attacker with high privileges to execute malicious scripts in the context of the affected application, potentially leading to limited disclosure of information, modification of data, or disruption of service. The CVSS score indicates low-level impact on confidentiality, integrity, and availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently available, users should monitor for updates from Logo Software Inc. and apply version 1.18 or later once released. Until then, restrict high privilege access to trusted users only to reduce risk.