The arisoft ARI Fancy Lightbox plugin versions up to 1.3.17 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with low privileges to inject malicious scripts that are stored and later executed in the context of users viewing the affected pages. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, required privileges, and user interaction, with partial impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users visiting the affected site, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium based on the CVSS score and the nature of stored XSS vulnerabilities. However, no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the ARI Fancy Lightbox plugin if feasible. Implementing web application firewalls or input sanitization at the application level may help mitigate risk, but these are not substitutes for an official patch.