The vulnerability CVE-2025-22794 affects the ianhaycox World Cup Predictor application (versions <= 1.9.8) and is classified as a reflected cross-site scripting (XSS) issue. It occurs due to improper neutralization of user-supplied input during the generation of web pages, enabling attackers to inject malicious scripts that execute when a victim loads a crafted URL. The CVSS v3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low levels. There is no vendor advisory or patch link available, and the product is not a cloud service.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to partial disclosure of sensitive information, manipulation of data, or disruption of service. The CVSS score reflects low-level impacts on confidentiality, integrity, and availability, but the scope is changed, indicating the vulnerability affects components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and output encoding controls where possible to mitigate reflected XSS risks. Monitor for updates from the vendor or trusted security sources regarding patches or official mitigations.