CVE-2025-13183 is a stored XSS vulnerability classified under CWE-79 affecting Otello versions 2.4.0 through before 2.4.4 by Hotech Software Inc. The flaw results from improper input neutralization during web page generation, enabling attackers with low complexity and limited privileges, but requiring user interaction, to execute arbitrary scripts in the context of the victim's browser. The CVSS 3.1 base score is 7.3 (High), reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. No patch or official fix information is currently available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to disclosure or modification of sensitive information (confidentiality and integrity impacts). Availability is not affected. The attack requires user interaction and low privileges, making exploitation feasible but not trivial.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor communications for updates on patches or official fixes.