CVE-2025-23604 describes a stored cross-site scripting vulnerability in the Maeve Lander Rezdy Reloaded software versions up to 1.0.1. The issue is caused by improper input neutralization during web page generation, which allows an attacker to inject malicious scripts that persist and execute in the context of other users' browsers. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting a network attack vector, low complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information provided, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The impact is rated high based on the CVSS score of 7.1. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Maeve Lander's advisories for updates. Until a fix is available, consider applying input validation or output encoding workarounds if feasible. Avoid exposing vulnerable versions in untrusted environments and limit user interactions with untrusted inputs where possible.