This vulnerability involves improper neutralization of input (CWE-79) in the OpenStreetMap for Gutenberg and WPBakery Page Builder plugin by Step-Byte-Service GmbH, leading to stored cross-site scripting (XSS). An attacker with low privileges can inject malicious scripts that execute when a user views the affected page, potentially impacting confidentiality, integrity, and availability to a limited extent. The vulnerability affects versions through 1.1.1. No vendor advisory or patch information is currently provided, and the vulnerability is publicly disclosed as of March 29, 2024.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to limited disclosure of information, modification of data, or disruption of service. The CVSS vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with partial impact on confidentiality, integrity, and availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting user input where possible and applying web application firewall (WAF) rules to detect and block potential XSS payloads. Monitor official Step-Byte-Service GmbH communications for updates.