CVE-2025-58626 describes a Stored Cross-site Scripting vulnerability in RumbleTalk Live Group Chat (<= 6.3.5) caused by improper input neutralization during web page generation. This flaw allows attackers with limited privileges and requiring user interaction to inject malicious scripts that execute in the context of other users' browsers, potentially leading to partial compromise of confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in users' browsers, potentially exposing sensitive information, modifying content, or disrupting service. The CVSS score of 6.5 reflects a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and partial impact on confidentiality, integrity, and availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider applying temporary input validation or output encoding controls if possible. Monitor vendor channels for updates regarding patches or official mitigations.