This vulnerability in Sunshine Photo Cart (<= 3.2.5) is due to improper neutralization of input during web page generation, resulting in cross-site scripting (XSS). The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated as low to low to low respectively. The vulnerability allows attackers to execute arbitrary scripts in the context of users visiting affected pages. No patch or vendor advisory is currently referenced, and the product is not a cloud service.

Successful exploitation can lead to execution of malicious scripts in users' browsers, potentially allowing attackers to steal sensitive information, manipulate web content, or disrupt availability of affected web pages. The impact is rated as high severity with limited confidentiality, integrity, and availability impacts. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding workarounds if feasible. Monitor vendor channels for updates and apply patches promptly once released.