CVE-2025-23491 describes a reflected cross-site scripting vulnerability in VSTEMPLATE Creator (<= 2.0.2) caused by improper input neutralization during web page generation. This flaw allows attackers to inject malicious scripts that execute when a user interacts with crafted web content generated by the affected software. The CVSS v3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser session, potentially resulting in limited disclosure of information, modification of data, or disruption of service. The CVSS vector indicates confidentiality, integrity, and availability impacts, but the extent is limited by the reflected nature of the XSS and requirement for user interaction. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input or links generated by VSTEMPLATE Creator. Implementing web application firewalls or input validation controls may help mitigate risk, but these are general recommendations and not confirmed mitigations specific to this vulnerability.