The vulnerability CVE-2025-23706 in milordk's Jet Skinner for BuddyPress plugin is a reflected cross-site scripting (XSS) issue caused by improper input sanitization during web page generation. This flaw affects all versions up to 1.2.5 and allows attackers to inject malicious scripts that execute when a user interacts with a crafted link or input, potentially compromising user data and application behavior. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal user credentials, manipulate content, or disrupt service availability. The CVSS score reflects partial impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor milordk's official channels for updates. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts specific to this plugin. Avoid clicking on suspicious links that may trigger the vulnerability.