The vulnerability CVE-2025-52782 affects King Rayhan Scroll UP plugin versions up to 2.0 and involves improper neutralization of input during web page generation, resulting in a reflected cross-site scripting (XSS) flaw. This allows an attacker to inject malicious scripts that execute when a user interacts with crafted input, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.1, indicating high severity, with an attack vector of network, low attack complexity, no privileges required, user interaction required, and scope changed. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this reflected XSS vulnerability can lead to limited confidentiality, integrity, and availability impacts, such as theft of user session data, defacement, or execution of arbitrary scripts in the victim's browser context. The scope is changed, meaning the vulnerability affects resources beyond the vulnerable component. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding workarounds if feasible. Monitor official King Rayhan communications for updates and apply patches promptly once available.