CVE-2025-54688 describes a stored cross-site scripting vulnerability in Crocoblock JetEngine (<= 3.7.1.2) caused by improper input neutralization during web page generation. This allows attackers with limited privileges and requiring user interaction to inject malicious scripts that can affect confidentiality, integrity, and availability to a limited extent. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, privileges required, user interaction, and a scope change.

Successful exploitation of this vulnerability can lead to execution of malicious scripts in the context of the affected web application, potentially resulting in limited confidentiality, integrity, and availability impacts. The CVSS vector indicates that an attacker with low privileges and requiring user interaction could exploit this remotely over the network. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting privileges of users who can input data into JetEngine and apply any recommended temporary mitigations from Crocoblock. Monitor vendor channels for updates regarding patches or official fixes.