CVE-2025-46250 describes a stored cross-site scripting vulnerability in VPSUForm up to version 3.1.14, caused by improper input neutralization during web page generation. This flaw allows an attacker with high privileges to inject malicious scripts that are stored and later executed when other users view the affected content. The vulnerability has a CVSS 3.1 score of 5.9, reflecting medium severity with network attack vector, low attack complexity, required privileges, and user interaction. The impact includes limited confidentiality, integrity, and availability loss. There is no vendor advisory or patch information available at this time, and no known active exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject and store malicious scripts in the VPSUForm application, which execute when viewed by other users. This can lead to limited disclosure of information, modification of data, and potential disruption of service. However, exploitation requires both high privileges and user interaction, reducing the overall risk. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is available, users should monitor vendor communications for updates. Until a fix is released, restricting access to trusted users and minimizing exposure of the vulnerable application may reduce risk.