This vulnerability (CVE-2025-52759) in UnboundStudio Accordion FAQ is categorized as CWE-79, indicating improper neutralization of input during web page generation leading to reflected cross-site scripting (XSS). It affects versions through 2.2.1 and has a CVSS 3.1 base score of 7.1, reflecting high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No official fix or patch has been published yet, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS score of 7.1 indicates a high impact but requires user interaction and no privileges. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider applying any recommended temporary mitigations from the vendor. Avoid exposing the vulnerable component to untrusted users if possible and monitor for updates from UnboundStudio.