This vulnerability (CVE-2025-22763) in NotFound's Brizy Pro product is a reflected cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. It allows an attacker to inject malicious scripts that execute in the context of a victim's browser when they interact with a crafted link or input. The vulnerability affects versions through 2.6.1. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no privileges, but requires user interaction. The impact includes partial confidentiality, integrity, and availability loss. No official fix or patch has been published as of the provided data.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. The CVSS score of 7.1 reflects a high severity with network attack vector and user interaction required. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should exercise caution with untrusted input and consider temporary mitigations such as input validation or web application firewalls to detect and block malicious payloads. Monitor vendor communications for updates on patches or official fixes.