CVE-2025-48352 is a stored cross-site scripting vulnerability in the sitesearch-yandex Yandex Site search pinger component, affecting versions up to 1.5. It results from improper neutralization of input during web page generation, enabling attackers to inject malicious scripts that are stored and executed when users access affected pages. The vulnerability has a CVSS 3.1 score of 5.9, reflecting medium severity with network attack vector, low attack complexity, required privileges at high level, and user interaction needed. The impact includes limited confidentiality, integrity, and availability loss. No patch or vendor advisory information is available, and no known exploits have been reported.

The vulnerability allows stored cross-site scripting attacks that can lead to limited confidentiality, integrity, and availability impacts. Exploitation requires high privileges and user interaction, which reduces the likelihood of widespread exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component to trusted users only and consider applying input validation or output encoding controls if possible to mitigate stored XSS risks.