The vulnerability CVE-2025-64198 affects appscreo Easy Social Share Buttons (versions before 10.7.1) and is classified as a reflected Cross-site Scripting (XSS) flaw. It results from improper input sanitization during web page generation, enabling attackers to inject and execute arbitrary scripts via crafted input. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. The product is a cloud service, and the vendor manages remediation server-side.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, data manipulation, or disruption of service. The reflected XSS nature requires user interaction to trigger the malicious payload. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

The vendor has released a patch for this vulnerability in version 10.7.1. Since this is a cloud-hosted service, the vendor manages remediation on the server side. Users of the service should verify with the vendor that their instance has been updated to the patched version. No additional user action is required if the vendor confirms the update.