CVE-2025-58873 describes a stored cross-site scripting vulnerability in pusheco Pushe Web Push Notification (versions up to 0.5.0). The issue is caused by improper neutralization of input during web page generation, which allows an attacker to inject malicious scripts that persist and execute when viewed by other users. The vulnerability has a CVSS 3.1 score of 5.9 with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, requires high privileges and user interaction, with a scope change and low impact on confidentiality, integrity, and availability. No patch or official remediation information is provided in the available data.

The vulnerability allows stored cross-site scripting attacks that can lead to the execution of malicious scripts in the context of affected users. This can result in limited confidentiality, integrity, and availability impacts. Exploitation requires high privileges and user interaction, which reduces the overall risk. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting high-privilege user input and applying input validation or sanitization where possible may reduce risk.