CVE-2025-22365 is a stored cross-site scripting vulnerability in EMC2 Alert Boxes by Eric McNiece, affecting versions up to 1.3. It results from improper input neutralization during web page generation, enabling attackers to inject and store malicious scripts that execute when viewed by other users. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, required privileges, and user interaction, with partial impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no exploits have been observed in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of sensitive information, modification of data, or disruption of availability. The CVSS vector indicates that the attacker requires low privileges and user interaction, and the impact affects confidentiality, integrity, and availability to a limited extent. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block potential XSS payloads. Monitor vendor channels for updates and apply patches promptly once available.