This vulnerability (CVE-2025-60179) in Space Studio Click & Tweet is a stored cross-site scripting (CWE-79) issue caused by improper input sanitization during web page generation. It affects versions up to 0.8.9 and allows attackers with high privileges and user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The medium CVSS score reflects these moderate risks. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates. Until a fix is available, limit high-privilege user access and exercise caution with user-generated content to reduce risk.