CVE-2025-32175 describes a stored cross-site scripting vulnerability in Vektor, Inc.'s VK Filter Search product, versions up to 2.20.2. The issue is caused by improper neutralization of input during web page generation, which allows an attacker to inject and store malicious scripts that execute when other users view the affected pages. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, required privileges, and user interaction, with impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. Attackers could execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious actions. However, exploitation requires user interaction and some privileges, limiting the ease of attack. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates and apply patches promptly once available.