CVE-2025-58646 describes a stored cross-site scripting vulnerability in the Mobi2Go product by chtombleson, present in versions up to 1.0.0. The issue stems from improper neutralization of input during web page generation, which can allow an attacker with high privileges to inject malicious scripts that execute when other users view affected pages. The vulnerability has a CVSS 3.1 score of 5.9, reflecting medium severity with network attack vector, low attack complexity, required privileges, and user interaction. No patch or vendor advisory information is currently available.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The attack requires user interaction and privileges, reducing the overall risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict high privilege access to trusted users only and exercise caution with user input handling. Monitor vendor communications for updates on remediation.