CVE-2025-58260 is a stored cross-site scripting vulnerability in Ronald Huereca Highlight and Share (<= 5.1.1) caused by improper input neutralization during web page generation. This allows attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 6.5 reflects the medium severity of this vulnerability. No patch or official remediation information is provided in the available data.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability at a limited level. However, exploitation requires user interaction and low privileges, reducing the overall risk severity to medium. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider applying any available temporary mitigations recommended by the vendor. Monitor for updates from Ronald Huereca regarding patches or workarounds.