The vulnerability identified as CVE-2025-23578 affects the Bastien Ho Custom CSS Addons plugin (versions up to 1.9.1). It is a reflected cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that execute when a user interacts with crafted content, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and scope changed.

Successful exploitation of this vulnerability can allow attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of sensitive information, modification of data, or disruption of service. The CVSS vector indicates partial impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided in the available data, users should monitor for updates from the Bastien Ho project. Until a fix is available, consider applying input validation or output encoding workarounds if feasible, and limit exposure to untrusted input where possible.