CVE-2025-58196 describes a stored cross-site scripting (XSS) vulnerability in uicore UiCore Elements affecting versions up to 1.3.4. The issue arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in the context of users viewing affected pages. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring low privileges and user interaction, and impacting confidentiality, integrity, and availability to a limited extent.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to partial disclosure of information, modification of data, or disruption of service. The CVSS vector indicates that the attack requires some user interaction and low privileges but can be performed remotely over the network. There are no known exploits in the wild at this time.

No patch or official remediation guidance is currently available for this vulnerability. Users should monitor the vendor's advisories for updates and apply any official fixes once released. Until then, consider implementing web application firewalls or input validation controls as temporary mitigations where feasible.