This vulnerability in Button contact VR (Buttonizer) is due to improper input sanitization when generating web pages, leading to stored cross-site scripting (XSS). An attacker could inject malicious scripts that persist on the affected web pages and execute in the context of users' browsers. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability at a low level. The affected versions include all up to 4.7.9.1. No patch or vendor advisory is currently provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, modification of content, or disruption of service. The impact is rated medium due to the requirement for high privileges and user interaction, and the limited scope of confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting access to the affected plugin, applying input validation or sanitization controls if possible, and monitoring for suspicious activity related to stored XSS. No official fix or temporary workaround is documented at this time.