This vulnerability in Karl Kiesinger GWP-Histats (up to version 1.0) is a stored cross-site scripting (CWE-79) flaw caused by improper input neutralization during web page generation. An attacker could inject malicious scripts that persist on the server and execute in the context of users' browsers, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 6.5 reflects network attack vector, low attack complexity, required privileges, user interaction, and scope change.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to partial disclosure of information, modification of data, and disruption of service. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. No known active exploitation has been reported.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should consider applying general XSS mitigations such as input validation and output encoding where possible, and restrict privileges of users who can submit content. Monitor vendor channels for updates.