CVE-2025-51684 affects CleverTap Web SDK version 1.15.1. The vulnerability is a Cross Site Scripting (XSS) flaw caused by improper sanitization of untrusted data received through window.postMessage. The malicious payload is injected into the DOM via the renderCustomHtml function, enabling execution of arbitrary JavaScript in the context of the hosting web page. This can lead to partial confidentiality and integrity impacts but does not affect availability. No official patch or remediation level has been published, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to execute arbitrary JavaScript code within the security context of the hosting site, potentially leading to partial disclosure of sensitive information and modification of site content. There is no reported impact on system availability. The vulnerability requires no privileges and has low attack complexity but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation or sanitization on messages received via window.postMessage as a temporary mitigation. Monitor vendor channels for updates and apply official patches once released.