The vulnerability CVE-2025-30869 affects Parakoos Image Wall (<= 3.0) and is caused by improper neutralization of input during web page generation, resulting in a reflected cross-site scripting (XSS) flaw. An attacker can craft malicious input that is reflected in the web page without proper sanitization, enabling script execution in the victim's browser. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low levels.

Successful exploitation allows attackers to execute arbitrary scripts in users' browsers when they visit a crafted URL, potentially leading to partial disclosure of sensitive information, modification of web content, or disruption of service. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input on affected versions of Parakoos Image Wall. Implementing web application firewall (WAF) rules to detect and block reflected XSS payloads may provide temporary mitigation.