CVE-2025-62920 describes a stored cross-site scripting vulnerability in webnique's USERCENTRICS CMP product, affecting versions up to 1.0.9. The issue is caused by improper input neutralization during web page generation, enabling attackers to inject and store malicious scripts that execute in the context of users' browsers. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, and user interaction needed, with impacts on confidentiality, integrity, and availability rated as low. No patch or vendor advisory information is provided, and no known exploits are reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges and user interaction to execute stored malicious scripts in the context of affected users, potentially leading to limited disclosure of information, modification of data, or disruption of service. The overall impact is rated medium severity with limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider implementing additional input validation or output encoding as temporary mitigations. Monitor vendor communications for updates on patches or official mitigations.