Themesgrove WidgetKit up to version 2.4.8 contains a stored XSS vulnerability (CWE-79) due to improper input neutralization during web page generation. This flaw allows attackers with at least low privileges and requiring user interaction to inject malicious scripts that can execute in the context of other users' browsers. The vulnerability has a CVSS score of 6.5 with network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users' browsers, potentially leading to partial confidentiality, integrity, and availability impacts. This could result in unauthorized actions performed on behalf of users or exposure of sensitive information. However, exploitation requires user interaction and some privileges, limiting the ease of attack. No known active exploitation has been reported.

No official patch or remediation guidance is currently available from the vendor. Users and administrators should monitor the vendor's communications for updates and apply patches once released. Until then, consider restricting user input where possible and applying web application firewall (WAF) rules to detect and block suspicious input patterns related to XSS. Avoid relying on generic mitigations unless specifically tailored to this vulnerability.