CVE-2025-58691 describes a stored cross-site scripting vulnerability in Genesis Club Lite software by Russell Jamieson, affecting versions up to 1.17. The vulnerability is due to improper input neutralization during web page generation, which can allow attackers to inject malicious scripts that persist and execute in the context of users' browsers. The CVSS 3.1 score of 6.5 reflects a medium severity with network attack vector, low complexity, requiring low privileges and user interaction, and partial impact on confidentiality, integrity, and availability. No patch or vendor advisory information is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the affected web application, potentially leading to limited disclosure of information, modification of data, or disruption of availability. The impact is rated medium based on the CVSS score. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing temporary input validation or output encoding controls if feasible. Monitor vendor communications for patches or updates addressing this vulnerability.