The vulnerability CVE-2025-69003 affects QantumThemes KenthaRadio (<= 2.2.0) and is caused by improper neutralization of input during web page generation, resulting in reflected cross-site scripting (XSS). This allows attackers to inject malicious scripts that execute when a victim accesses a crafted URL or input, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other actions that impact confidentiality, integrity, and availability to a limited extent. The scope is changed, meaning the vulnerability affects resources beyond the initially vulnerable component. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts and educate users to avoid clicking suspicious links. Monitor official QantumThemes communications for updates and apply official fixes once released.