CVE-2025-67290 is a stored XSS vulnerability in Piranha CMS v12.1's Page Settings module. Attackers can inject crafted payloads into the Excerpt field, which are then stored and executed when rendered, potentially leading to script execution in the victim's browser. The vulnerability requires no privileges and no user interaction beyond viewing the affected content. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact with no availability impact.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of users viewing the affected page excerpt. This can lead to theft of user credentials, session hijacking, or other malicious actions performed on behalf of the victim user. The impact is limited to confidentiality and integrity with no direct availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid entering untrusted data into the Excerpt field and consider applying input sanitization or output encoding as a temporary mitigation.