The vulnerability CVE-2025-23482 affects the azurecurve Floating Featured Image plugin (up to version 2.2.0) and is caused by improper neutralization of input during web page generation, resulting in a reflected Cross-site Scripting (XSS) flaw. This allows attackers to inject malicious scripts that can execute in the context of a user's browser. The CVSS 3.1 base score is 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. The product is cloud-hosted, and a patch is available from the vendor.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to data theft, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of user data. The reflected XSS nature requires user interaction. No known exploits are currently reported in the wild.

A patch is available to remediate this vulnerability. Since the product is a cloud service, the vendor manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied or that the service is updated. No additional user action is required if the vendor confirms mitigation.