This vulnerability (CVE-2025-64637) affects Opal_WP Auros Core versions up to and including 5.3.1. It is classified as CWE-80, indicating improper neutralization of script-related HTML tags in a web page, which results in unauthenticated content injection. The CVSS 3.1 base score is 5.3 (medium), with attack vector network, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is available at this time.

An attacker can inject content into the affected web application without authentication, potentially leading to the execution of malicious scripts in the context of users viewing the affected pages. The impact is limited to confidentiality (partial information disclosure) with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to vulnerable endpoints or applying web application firewall (WAF) rules to detect and block suspicious script injections specific to this vulnerability.