The vulnerability CVE-2025-22322 affects DeluxeThemes Private Messages for UserPro (versions up to 4.10.0) and is classified as a reflected cross-site scripting (XSS) flaw. It results from improper neutralization of user input during web page generation, which can lead to execution of malicious scripts in the victim's browser. The CVSS 3.1 base score is 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes low confidentiality, integrity, and availability impacts. There is no vendor advisory or patch information currently available, and the product is not a cloud service, so remediation depends on vendor patch release.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, manipulation of web content, or disruption of service. The CVSS vector indicates partial impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution with untrusted input and consider applying temporary mitigations such as input validation or web application firewalls if feasible. Monitor official DeluxeThemes communications for updates and apply official fixes promptly once released.