CVE-2025-68524 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting ThemeGoods Avante versions before 3.0.5. The issue stems from improper input neutralization during web page generation, enabling attackers to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation can lead to limited confidentiality, integrity, and availability impacts by executing malicious scripts in the context of users visiting the affected web pages. This could result in theft of sensitive information, session hijacking, or other client-side attacks. However, exploitation requires user interaction and is unauthenticated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting the affected application. Avoid relying on generic mitigations unless specifically recommended by the vendor.