CVE-2025-15636 describes a stored cross-site scripting vulnerability (CWE-79) in Emarket-design's YouTube Showcase software versions up to 3.5.1. The issue results from improper input neutralization during web page generation, which can allow attackers to inject and store malicious scripts that execute in the context of other users' browsers. The vulnerability has a CVSS 3.1 score of 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been published, and no known exploits are reported. The product is not cloud-hosted, so remediation depends on vendor patching.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting the affected YouTube Showcase pages. This can lead to partial compromise of confidentiality, integrity, and availability of user data within the affected application. However, no known exploits are currently reported, and the impact is rated medium severity based on the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is available, users should limit exposure by restricting input sources and applying any available input validation controls. Monitor vendor communications for updates and apply patches promptly once released.