This vulnerability in BA Book Everything (<= 1.6.20) is caused by improper neutralization of input during web page generation, resulting in a cross-site scripting (XSS) flaw. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. The vulnerability allows an attacker to inject malicious scripts that execute in the context of the victim's browser session, potentially leading to data theft or session hijacking.

Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of the affected system by executing arbitrary scripts in users' browsers. This can result in theft of sensitive information, session hijacking, or other malicious actions performed with the user's privileges. However, exploitation requires user interaction and network access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is currently available. Users should monitor vendor communications for updates and consider applying any forthcoming patches promptly. Until a fix is available, cautious handling of untrusted input and limiting exposure to untrusted users may reduce risk.