CVE-2025-53325 is a medium-severity vulnerability classified under CWE-79, which corresponds to Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS). This vulnerability affects the 'Beauty Contact Popup Form' product developed by Dilip Kumar, specifically versions up to 6.0. The flaw allows for Stored XSS attacks, where malicious scripts injected by an attacker are permanently stored on the vulnerable web application and executed in the browsers of users who access the affected pages. The CVSS 3.1 base score is 5.9, indicating a medium level of risk. The vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) reveals that the attack can be launched remotely over the network (AV:N) with low attack complexity (AC:L), but requires high privileges (PR:H) and user interaction (UI:R). The scope is changed (S:C), meaning the vulnerability affects resources beyond the initially vulnerable component. The impact affects confidentiality, integrity, and availability to a limited extent (C:L/I:L/A:L). No known exploits are currently reported in the wild, and no patches or mitigation links have been provided yet. Stored XSS vulnerabilities can lead to session hijacking, defacement, phishing, or distribution of malware, impacting users and the reputation of the affected organization. The vulnerability arises from insufficient input sanitization or output encoding in the contact popup form, allowing attackers to inject malicious JavaScript code that executes in the context of other users' browsers.

For European organizations using the Beauty Contact Popup Form, this vulnerability poses a risk of client-side attacks that can compromise user data confidentiality and integrity, as well as availability of services. Attackers exploiting this flaw could steal session cookies, perform actions on behalf of authenticated users, or redirect users to malicious sites. This can lead to data breaches, loss of customer trust, regulatory non-compliance (such as GDPR violations), and potential financial penalties. Since the vulnerability requires high privileges and user interaction, internal users or administrators with access to the form may be targeted to inject malicious payloads. The scope change indicates that the impact could extend beyond the immediate component, potentially affecting other integrated systems or services. European organizations with customer-facing websites or portals using this form are particularly at risk, as attackers could leverage the vulnerability to target end users or employees. The absence of known exploits in the wild currently reduces immediate risk but does not eliminate the potential for future attacks once exploit code becomes available.

1. Immediate code review and implementation of proper input validation and output encoding in the Beauty Contact Popup Form to neutralize malicious scripts. Use context-aware encoding libraries to sanitize user inputs before rendering them on web pages. 2. Employ Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts and reduce the impact of XSS attacks. 3. Limit privileges required to access and modify the contact popup form to reduce the risk of high-privilege exploitation. 4. Conduct regular security testing, including automated scanning and manual penetration testing focused on XSS vulnerabilities. 5. Monitor web application logs for unusual input patterns or script injection attempts. 6. Educate internal users and administrators about the risks of XSS and safe handling of web forms. 7. If possible, isolate the vulnerable component or disable the contact popup form temporarily until a patch or update is available. 8. Stay updated with vendor advisories for patches or fixes and apply them promptly once released.