The vulnerability CVE-2025-27016 involves improper input neutralization leading to stored cross-site scripting in the awsm.in Drivr Lite – Google Drive Plugin (drivr-google-drive-file-picker) up to version 1.0.1. This allows attackers with low privileges and requiring user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability of the affected system. The vulnerability is present in a cloud service environment, which generally means the vendor applies patches on the server side. The CVSS vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and a scope change with partial impacts on confidentiality, integrity, and availability.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected users, potentially leading to information disclosure, modification of data, or disruption of service. The CVSS score of 6.5 reflects a medium impact on confidentiality, integrity, and availability. However, no active exploits have been reported in the wild.

A patch is available for this vulnerability. Since the affected product is a cloud service, the vendor typically manages remediation server-side. Users and administrators should verify with the vendor advisory that the service has been updated to address this issue. No additional action is required if the vendor confirms the patch has been applied.