This vulnerability in Rometheme RTMKit allows stored cross-site scripting due to improper input neutralization during web page generation. It affects all versions up to 1.5.0. An attacker could inject malicious scripts that are stored and later executed in the context of users' browsers, potentially leading to information disclosure, session hijacking, or other impacts typical of stored XSS. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability requires some level of privilege and user interaction, which moderates the risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider limiting exposure by restricting privileges where possible and exercising caution with user-generated content. Monitor official Rometheme communications for updates and apply any official fixes promptly once released.