CVE-2025-22791 is a reflected Cross-site Scripting (XSS) vulnerability classified under CWE-79 in the twh offset writing product, affecting versions up to 1.2. The issue stems from improper neutralization of input during web page generation, which allows malicious input to be reflected in the web response. The vulnerability has a CVSS 3.1 base score of 7.1, with an attack vector over the network, low complexity, no privileges required, but requiring user interaction. The impact includes limited confidentiality, integrity, and availability loss. No patch or official fix has been documented, and no known exploits have been observed in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to theft of user data, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS vector indicates limited but non-negligible impact on these security properties. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor for vendor updates. Until a fix is available, consider applying input validation or output encoding workarounds if feasible to mitigate reflected XSS risks.