CVE-2025-51965 describes a Cross-Site Scripting (XSS) vulnerability in OURPHP through version 8.6.1. The issue arises from insufficient input sanitization of the "Name" field in the "Complete Profile" functionality under the "My User Center" page, which is accessible after user registration via the front-end interface. This vulnerability allows attackers to inject malicious scripts that may be executed in the browsers of other users, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable over the network without privileges, requires user interaction, and affects confidentiality and integrity with no impact on availability.

Successful exploitation of this XSS vulnerability can lead to the execution of arbitrary scripts in the context of affected users, potentially allowing attackers to steal session tokens, manipulate web content, or perform actions on behalf of the user. The impact is limited to confidentiality and integrity, with no direct availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and output encoding on the "Name" field to mitigate the risk. Additionally, restricting or sanitizing user input in the affected functionality can reduce exposure. Monitor vendor channels for updates regarding an official patch.