The vulnerability CVE-2025-58820 affects Themepoints Carousel Ultimate (<= 1.8) and is a Stored Cross-site Scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows attackers with high privileges to inject malicious scripts that are stored and executed when other users view the affected content. The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, low attack complexity, required privileges, and user interaction. No patch or vendor advisory information is currently available.

Successful exploitation can lead to limited confidentiality, integrity, and availability impacts due to stored XSS. Attackers may execute arbitrary scripts in the context of affected users, potentially leading to session hijacking or content manipulation. However, exploitation requires high privileges and user interaction, which limits the scope and ease of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege user access and validate or sanitize inputs manually where possible to reduce risk.