This vulnerability, identified as CWE-79, involves improper neutralization of input in the Coupon & Discount Code Reveal Button plugin, which leads to Stored Cross-site Scripting (XSS). The flaw allows attackers with high privileges and user interaction to inject malicious scripts that can compromise confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, low attack complexity, and required privileges and user interaction.

Successful exploitation can result in limited confidentiality, integrity, and availability impacts due to stored XSS. Attackers could execute malicious scripts in the context of affected users, potentially leading to session hijacking or unauthorized actions within the application context. However, exploitation requires high privileges and user interaction, reducing the overall risk.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, limit exposure by restricting high-privilege user access and monitoring for suspicious input where feasible.