This vulnerability in Brainstorm Force Astra Widgets (<= 1.2.14) involves improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). An attacker could inject malicious scripts that are stored and later executed in the browsers of users who visit the affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impact on confidentiality, integrity, and availability rated as low to low to low respectively, combined to a medium severity score of 6.5.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. However, the attack requires some level of privileges and user interaction, which limits the ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider applying any available temporary mitigations recommended by the vendor. Monitor official Brainstorm Force communications for updates on patches or workarounds.