This vulnerability in html5maps Interactive World Map (<= 3.4.4) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker with low privileges can inject malicious scripts that may be executed in the context of other users, potentially impacting confidentiality, integrity, and availability. The CVSS v3.1 score of 6.5 reflects network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing the affected web pages, potentially leading to partial loss of confidentiality, integrity, and availability of data. The attack requires user interaction and low privileges, which limits but does not eliminate risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting privileges and limiting exposure to untrusted input in the affected application. Monitor vendor channels for updates regarding patches or mitigations.