This vulnerability in Broadstreet XPRESS WordPress Ad Widget (up to version 2.20.0) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (CWE-79). An attacker with high privileges and requiring user interaction could inject malicious scripts that execute in the context of affected users. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, and user interaction needed, with impacts on confidentiality, integrity, and availability rated as low to low to low respectively.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute when other users view the affected content, potentially leading to unauthorized actions or data exposure within the context of the affected WordPress site. The impact on confidentiality, integrity, and availability is rated as low. No known active exploitation has been reported.

No official patch or remediation is currently available. Users should follow vendor advisories for updates. Until a fix is released, limiting high privilege access and carefully validating input where possible may reduce risk. Monitor for updates from Broadstreet XPRESS regarding this vulnerability.