The Pixel Industry TweetScroll Widget contains a stored XSS vulnerability (CWE-79) due to improper input neutralization during web page generation. This flaw allows malicious scripts to be stored and executed in the context of users viewing the widget. The vulnerability affects all versions up to 1.3.7. The CVSS 3.1 score of 5.5 reflects a network attack vector requiring low privileges and user interaction, with limited impact on confidentiality, integrity, and availability. No vendor-provided patch or mitigation details are currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users interacting with the TweetScroll Widget, potentially leading to limited confidentiality, integrity, and availability impacts. However, the overall severity is medium, and no active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting exposure to untrusted inputs in the widget or disabling it if feasible. Monitor vendor channels for updates on patches or official mitigations.