CVE-2025-68524 is an unauthenticated cross-site scripting (XSS) vulnerability in ThemeGoods Avante affecting versions before 3.0.5. The vulnerability arises from improper neutralization of input during web page generation (CWE-79), allowing attackers to inject malicious scripts that could lead to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low level. No vendor-provided patch or official remediation level is currently documented.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of sensitive information, modification of data, or disruption of service. The CVSS score of 7.1 reflects a high severity with impacts on confidentiality, integrity, and availability, though the attack requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any available workarounds or input validation controls if feasible. Monitor ThemeGoods communications for updates regarding patches or official mitigations.