This vulnerability (CVE-2025-23689) in Poco Blogger Image Import version 2.1 is a Stored Cross-site Scripting (CWE-79) issue caused by improper input neutralization during web page generation. It allows attackers to inject malicious scripts that persist and execute in the context of users' browsers, potentially leading to data theft, session hijacking, or other malicious actions. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No patch or official remediation has been disclosed by the vendor, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users' browsers, potentially leading to theft of sensitive information, session hijacking, or other unauthorized actions. The CVSS score of 7.1 indicates a high impact on confidentiality, integrity, and availability. However, there are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor for vendor updates and avoid exposing the vulnerable version in high-risk environments. Applying input validation or output encoding at the application level may reduce risk until an official patch is available.