This vulnerability in Essekia Helpie FAQ (<= 1.27) involves improper input neutralization during web page generation, resulting in stored cross-site scripting (XSS). An attacker with high privileges and requiring user interaction can exploit this to execute arbitrary scripts in a context where the plugin is used. The CVSS 3.1 base score is 5.9 with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The scope is changed, meaning the vulnerability affects resources beyond the initially vulnerable component. However, the impact is rated medium overall. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, limit high-privilege user access and be cautious with user interactions involving the Helpie FAQ plugin. Monitor official Essekia communications for updates and apply any official fixes promptly once released.