The CurrencyRate.today Crypto Converter Widget contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This flaw allows attackers to inject malicious scripts that persist and execute in the context of users viewing the widget. The vulnerability affects all versions up to 1.8.4. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability. No vendor-provided patch or official remediation level is currently documented.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of users interacting with the Crypto Converter Widget. This may result in partial loss of confidentiality, integrity, and availability of affected systems or data. However, no known active exploits have been reported, and the impact is rated medium severity based on the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure to the vulnerable widget or applying web application firewall rules to detect and block suspicious input patterns related to XSS. Monitor vendor communications for updates on patches or official mitigations.