This vulnerability in LH QR Codes (versions <= 1.06) involves improper input sanitization during web page generation, leading to stored cross-site scripting (XSS). An attacker could inject malicious scripts that persist and execute in the context of users viewing the affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low to low respectively. No patch or official fix information is provided in the available data.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. However, no known exploits in the wild have been reported, and the impact is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor for vendor updates and avoid using affected versions if possible. Implementing web application firewalls or input validation controls may help mitigate risk until a fix is available.