This vulnerability in Pretty Simple Popup Builder (<= 1.0.9) involves improper input neutralization during web page generation, leading to stored cross-site scripting (XSS). The flaw allows an attacker to inject malicious scripts that persist and execute when viewed by users with elevated privileges. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability at a low level. No patch or vendor advisory details are provided, and the plugin is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of privileged users interacting with the plugin, potentially leading to limited confidentiality, integrity, and availability impacts. The medium CVSS score reflects these moderate risks. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the plugin's administrative interfaces and apply standard XSS mitigations where possible. Monitor vendor channels for updates or patches addressing this vulnerability.