The vulnerability identified as CVE-2025-22282 affects the keksdieb ez Form Calculator Premium plugin, specifically versions up to 2.14.1.2. It is a reflected cross-site scripting (XSS) flaw caused by improper neutralization of user input during web page generation. This allows attackers to inject malicious scripts that execute in the context of users interacting with the affected web pages. The CVSS v3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official fix information is available from the vendor or advisory sources.

Successful exploitation of this reflected XSS vulnerability can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in partial disclosure of sensitive information, manipulation of data, or disruption of service. The CVSS score reflects impacts on confidentiality, integrity, and availability, but the exact scope depends on the context of use. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts and avoid exposing the vulnerable plugin in untrusted contexts. Monitor vendor channels for updates regarding patches or official mitigations.