This vulnerability (CWE-79) in azurecurve Toggle Show/Hide allows stored XSS due to improper input sanitization during web page generation. An attacker with low privileges and requiring user interaction can exploit this vulnerability remotely to execute arbitrary scripts in the context of affected users. The vulnerability affects all versions up to 2.1.3. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The product is cloud-hosted, which typically means vendor-managed remediation.

Successful exploitation can lead to execution of arbitrary scripts in users' browsers, potentially resulting in data disclosure, modification, or denial of service within the context of the affected application. The CVSS score of 6.5 reflects medium severity with partial impacts on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. Since the product is a cloud service, the vendor typically manages remediation server-side. Users and administrators should verify with the vendor advisory to confirm that the service has been updated to address this issue. Until then, avoid exposing the affected functionality to untrusted users. Monitor vendor communications for official patch deployment and guidance.