The vulnerability CVE-2025-62926 in HappyDevs TempTool (<= 1.3.1) is a stored cross-site scripting issue caused by improper input neutralization during web page generation. The affected parameter is current-template-name, which can be manipulated to inject malicious scripts that persist and execute in users' browsers. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to information disclosure, modification of data, or disruption of service. The impact is rated medium based on the CVSS score of 6.5. However, exploitation requires user interaction and some privileges, which limits the ease of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply strict input validation and output encoding on the current-template-name parameter to mitigate stored XSS risks. Additionally, restricting privileges and educating users about the risks of interacting with untrusted content can reduce exposure.