CVE-2025-23907 describes a stored cross-site scripting vulnerability in the seo-meta feature of SOCIAL.NINJA versions up to 0.2. The issue is due to improper input neutralization during web page generation, which can lead to persistent injection of malicious scripts. The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability at a low level. No official fix or patch has been published as of the data provided.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to information disclosure, data manipulation, or denial of service. The impact is rated medium due to the requirement of user interaction and limited privileges for the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a fix is released, consider restricting user input in the seo-meta component and applying web application firewall (WAF) rules to detect and block XSS payloads if possible.