This vulnerability in TemplatesNext OnePager (up to version 1.3.3) is classified as CWE-79, indicating improper neutralization of input during web page generation that leads to stored cross-site scripting (XSS). An attacker could exploit this flaw by injecting malicious scripts that are stored and later executed in the context of users viewing the affected pages. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) reflects network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users interacting with the vulnerable TemplatesNext OnePager application. This may lead to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability as indicated by the CVSS metrics. However, no known exploits are reported in the wild.

No official patch or remediation level has been published by the vendor as of the current information. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or output encoding workarounds if feasible and monitor vendor communications for updates.