CVE-2025-23484 describes a reflected cross-site scripting vulnerability in Cojecto Predict When (<= 1.3). The issue is caused by improper neutralization of user input during web page generation, enabling attackers to inject and execute arbitrary scripts in users' browsers. The CVSS 3.1 base score is 7.1 (high), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and low impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability to a limited extent. The CVSS score reflects a high severity with partial impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any recommended temporary mitigations from the vendor or limit exposure by restricting access to the affected application. Monitor for updates from Cojecto regarding patches or workarounds.