The vulnerability CVE-2025-22532 affects snagysandor Simple Photo Sphere (<= 0.0.10) and is caused by improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). This allows an attacker with at least low privileges and requiring user interaction to inject malicious scripts that execute in the context of other users. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, user interaction needed, scope changed, and partial impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially allowing theft of sensitive information, session hijacking, or manipulation of application data. The impact is limited to partial confidentiality, integrity, and availability loss. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block XSS payloads. Monitor vendor channels for updates and apply patches promptly once released.