The vulnerability identified as CVE-2025-23656 affects the Donate visa product by Saul Morales Pacheco, specifically versions up to and including 1.0.0. It is characterized as a Missing Authorization issue that enables Stored Cross-Site Scripting (XSS). The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and a scope change with limited impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

Successful exploitation of this vulnerability could allow an attacker with low privileges and requiring user interaction to inject and store malicious scripts within the Donate visa application. This could lead to limited confidentiality, integrity, and availability impacts, such as unauthorized actions performed in the context of a legitimate user session. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from the vendor. Until a fix is available, consider restricting access to the affected versions and applying any available web application firewall (WAF) rules that may mitigate Stored XSS attacks.