This vulnerability, identified as CVE-2025-23851, affects the Coronavirus (COVID-19) Outbreak Data Widgets developed by Khushwant Singh, specifically versions up to 1.1.1. It is a reflected cross-site scripting (XSS) issue caused by improper neutralization of input during web page generation. The CVSS v3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low to high levels. The vulnerability allows an attacker to inject malicious scripts that execute when a user interacts with a crafted link or input, potentially leading to session hijacking, data manipulation, or denial of service. No patch or official fix information is currently available, and the product is not a cloud service.

Successful exploitation of this reflected XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. Specifically, attackers may execute arbitrary scripts in the victim's browser context, potentially stealing session tokens, manipulating displayed data, or causing denial of service. The CVSS vector indicates a high impact on availability and low to partial impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor channels for updates. In the meantime, avoid clicking on untrusted links that interact with the affected widgets and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts if possible.