CVE-2025-58626 is a Stored Cross-site Scripting vulnerability in RumbleTalk Live Group Chat (<= 6.3.5) caused by improper neutralization of input during web page generation. This allows an attacker with limited privileges and requiring user interaction to inject malicious scripts that execute in the context of other users, potentially impacting confidentiality, integrity, and availability of the application.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of the affected system due to execution of attacker-controlled scripts in users' browsers. The CVSS score of 6.5 reflects a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Users should monitor vendor communications for updates and apply patches once released. Until then, consider restricting user input or applying web application firewall rules to detect and block malicious payloads related to XSS.