The ThemeNcode Fan Page Widget suffers from a CWE-79 improper input neutralization vulnerability that enables stored cross-site scripting attacks. This occurs when user-supplied input is not properly sanitized before being embedded in web pages, allowing attackers to inject malicious scripts that persist and execute when other users view the affected pages. The vulnerability affects all versions up to 2.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability at a low level. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker with high privileges and requiring user interaction to execute arbitrary scripts in the context of the affected web application. This may lead to partial compromise of confidentiality, integrity, and availability of the affected system. However, no known exploits are reported in the wild, and the impact is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with the Fan Page Widget by ThemeNcode and consider limiting exposure or privileges associated with the widget. No vendor-provided mitigation or temporary fix is currently documented.