CVE-2025-22514 describes a reflected cross-site scripting vulnerability in the Yamna Khawaja KNR Author List Widget (versions up to 3.1.1). The issue stems from improper input neutralization during web page generation, which allows attackers to inject malicious scripts that execute when a victim interacts with crafted content. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low complexity, no privileges required, user interaction needed, and impacts confidentiality, integrity, and availability at a low level. No patch or official remediation guidance is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS score of 7.1 indicates a high severity impact but requires user interaction to exploit. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from Yamna Khawaja or the widget maintainers. Until a fix is available, consider applying input validation or output encoding workarounds if feasible, or restrict usage of the affected widget version. No vendor advisory states that no action is required or that the issue is already mitigated.