The vulnerability CVE-2025-47652 affects Infility Infility Global (up to version 2.13.4) and is caused by improper neutralization of input during web page generation, resulting in a reflected Cross-site Scripting (XSS) flaw. This allows an attacker to inject malicious scripts that execute in the victim's browser when they visit a crafted URL or web page. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low levels.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser session, potentially allowing theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability at a limited level. The scope change in the CVSS vector indicates the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules or input validation as temporary mitigations if feasible.