CVE-2025-27314 describes a stored cross-site scripting vulnerability in Kush Micro News (versions up to 1.6.7) caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that persist on the site and execute in the context of other users' browsers. The vulnerability has a CVSS score of 7.1, reflecting high severity with potential confidentiality, integrity, and availability impacts. The vulnerability is not known to be exploited in the wild, and no patch or vendor advisory information is provided, leaving the patch status unconfirmed.

Successful exploitation could allow attackers to execute arbitrary scripts in users' browsers, potentially leading to theft of user credentials, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider applying any available workarounds or input sanitization measures if possible. Monitor official channels for updates from Kush Sharma regarding patches or mitigations.