The vulnerability identified as CVE-2025-23524 affects dactum ClickBank Storefront (versions <= 1.7) and is a reflected cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that execute in users' browsers when they interact with crafted URLs or inputs. The CVSS v3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vulnerability was published on March 3, 2025, and no patch or vendor advisory has been provided yet.

Successful exploitation of this reflected XSS vulnerability could allow attackers to execute arbitrary scripts in the context of a victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of the affected system or user data. The CVSS score of 7.1 reflects a high impact with partial loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted inputs or URLs in the affected ClickBank Storefront versions. Implementing web application firewall (WAF) rules to detect and block reflected XSS attempts may provide temporary mitigation.