This vulnerability (CVE-2025-23923) in wackey Lockets is a reflected Cross-site Scripting (XSS) issue caused by improper neutralization of input during web page generation. It affects Lockets versions up to and including 0.999. The CVSS v3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated low to low. No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. However, exploitation requires user interaction and the attack is reflected, limiting the scope to targeted attacks. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input or links related to the affected product. Monitor vendor communications for updates regarding patches or mitigations.