CVE-2025-32680 is a stored cross-site scripting vulnerability in the Review Stream product by Grade Us, Inc., present in versions up to 1.6.7. It results from improper neutralization of input during web page generation, allowing attackers to inject and store malicious scripts that execute in the context of users viewing the affected pages. The vulnerability has a CVSS 3.1 base score of 5.9, with network attack vector, low attack complexity, requiring high privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited degree. No patch or official remediation information is provided in the available data. The product is not a cloud service, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject stored malicious scripts that execute when other users view the affected web pages. This can lead to limited confidentiality, integrity, and availability impacts such as session hijacking, data manipulation, or denial of service within the context of the Review Stream application. However, exploitation requires user interaction and elevated privileges, which limits the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor Grade Us, Inc. communications for updates. Until a fix is provided, consider restricting high-privilege user input capabilities and applying web application firewall rules to detect and block suspicious input patterns related to XSS.