The vulnerability CVE-2025-23750 affects devbunchuk's Custom Widget Creator (up to version 1.0.5) and is classified as a reflected cross-site scripting (XSS) issue. It results from improper sanitization of user input during web page generation, enabling attackers to inject and execute arbitrary scripts in users' browsers. The CVSS score is 7.1 (high), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated low to low to low respectively. No patch or official remediation information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser session, potentially leading to partial disclosure of sensitive information, modification of web content, or disruption of service. The CVSS vector indicates that the attack can be performed remotely without privileges but requires user interaction. The scope is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted inputs in the affected product. Implementing web application firewalls or input filtering may provide temporary mitigation but are not guaranteed to fully prevent exploitation.