This vulnerability (CVE-2025-26737) in yudleethemes City Store is classified as CWE-79, indicating improper neutralization of input leading to Cross-site Scripting (XSS). Specifically, it is a DOM-based XSS flaw that allows attackers to inject and execute malicious scripts in the context of the affected web application. The vulnerability affects City Store versions up to 1.4.5. The CVSS vector indicates the attack requires network access, low attack complexity, privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low and low respectively. No patch or vendor advisory is currently available, and no exploits have been observed in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to unauthorized actions or data disclosure within the context of the affected application. The CVSS score of 6.5 reflects a medium impact on confidentiality, integrity, and availability. However, exploitation requires user interaction and some privileges, which may limit the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds from the vendor or limit exposure by restricting access to trusted users. Monitoring for updates from yudleethemes is recommended to apply official patches once available.