The vulnerability CVE-2025-9969 affects Vizly Web Design Real Estate Packages prior to version 5.1 and is classified as CWE-79, indicating improper neutralization of input during web page generation leading to cross-site scripting (XSS). This vulnerability enables attackers to perform reflected XSS attacks, potentially resulting in content spoofing and session hijacking as identified by CAPEC-593 and CAPEC-591. The CVSS v3.1 base score is 7.1, reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability can lead to content spoofing and session hijacking, compromising the confidentiality of user data. The integrity impact is low, and availability is not affected. The vulnerability can be exploited remotely without privileges but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider implementing web application firewalls or input validation as temporary mitigations.