The vulnerability CVE-2025-26586 affects abelony Events Planner (<= 1.3.10) and is classified as a reflected cross-site scripting issue caused by improper input neutralization during web page generation. This flaw allows an attacker to inject malicious scripts that are reflected back to users, potentially enabling execution of arbitrary code within the victim's browser session. The CVSS v3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in the context of the affected web application users, potentially leading to theft of user data, session hijacking, or other malicious actions. The impact is rated as high due to the potential for confidentiality, integrity, and availability loss. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — no vendor advisory or patch links are currently available. Users should monitor the vendor's official channels for updates and apply any official fixes once released. In the meantime, applying web application firewall (WAF) rules to detect and block reflected XSS attempts may provide temporary mitigation.