This vulnerability in Jordy Meow Photo Engine (up to version 6.3.1) involves improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). It allows stored XSS attacks, where malicious scripts can be injected and persistently stored, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and scope changed, with low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges and user interaction to execute malicious scripts in the context of other users, potentially leading to limited disclosure or modification of data and some disruption of service. The impact is rated medium based on the CVSS score of 5.9. No known active exploitation has been reported.

No official patch or remediation is currently available. Users and administrators should monitor the vendor's advisories for updates. Until a fix is released, limiting high-privilege user access and exercising caution with user-generated content may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.