This vulnerability (CVE-2024-38725) in Webstix Admin Dashboard RSS Feed is a stored cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. An attacker with high privileges and requiring user interaction could inject malicious scripts that execute within the context of the application, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability affects versions up to 3.1 and has a CVSS 3.1 base score of 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L). No patch or official remediation level has been published by the vendor, and this is not a cloud service.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute stored malicious scripts in the context of the Webstix Admin Dashboard RSS Feed. This may lead to partial loss of confidentiality, integrity, and availability of the affected system. However, the impact is limited by the requirement for high privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Admin Dashboard RSS Feed to trusted users only and apply input validation or sanitization controls where possible to mitigate stored XSS risks.