CVE-2025-64047 identifies a Cross Site Scripting (XSS) vulnerability in OpenRapid RapidCMS version 1.3.1 specifically within the /user/user-move.php endpoint. The vulnerability allows remote attackers to execute scripts in the context of the victim's browser, potentially leading to limited confidentiality and integrity impacts. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and affects confidentiality and integrity with no impact on availability.

Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected user's browser session. This may lead to disclosure of sensitive information or manipulation of data accessible to the user. The impact is limited to confidentiality and integrity, with no direct impact on system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. In the meantime, consider applying input validation or output encoding controls on the affected endpoint to mitigate the risk.