CVE-2025-26558 describes a DOM-based Cross-site Scripting vulnerability in the mkkmail Aparat Responsive product, affecting versions up to 1.3. The issue arises from improper neutralization of input during web page generation, allowing potentially malicious scripts to be executed in the context of the affected web application. The vulnerability requires network access, low attack complexity, and user interaction, and it impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability could lead to limited disclosure of information, modification of data, or disruption of service within the affected application. The CVSS score of 6.5 reflects a medium severity level, indicating moderate risk to affected systems. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from the vendor. In the meantime, applying input validation and output encoding best practices may help mitigate risk.