This vulnerability (CVE-2024-31257) in Formsite's embedded online forms product involves improper input sanitization leading to stored cross-site scripting (CWE-79). Attackers can inject malicious scripts that persist within the application and execute when viewed by other users. The issue affects versions up to 1.6. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with impacts on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users' browsers, potentially leading to data theft, session hijacking, or disruption of service. The CVSS score of 6.5 reflects a medium severity with partial impacts on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting privileges and user interactions where possible and avoid using affected versions in high-risk environments. Monitor vendor communications for updates and apply patches promptly once available.