This vulnerability in the Automatically Hierarchic Categories in Menu plugin allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with low privileges and requiring user interaction can exploit this to achieve partial confidentiality, integrity, and availability impacts. The issue affects versions up to and including 2.0.5. No vendor advisory or patch information is currently provided.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing an attacker to steal user data, manipulate content, or disrupt availability. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability, all partial.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, limit exposure by restricting user input where possible and monitoring for suspicious activity related to this plugin. Avoid granting unnecessary privileges to users who can submit input processed by this plugin.