This vulnerability in bidbud TradeMe widgets (versions up to 1.2) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker could inject malicious scripts that persist in the widget and execute in the context of users viewing the affected pages. The CVSS 3.1 score is 6.5, reflecting network attack vector, low attack complexity, requiring privileges and user interaction, with impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to data disclosure, modification, or disruption of service. The impact affects confidentiality, integrity, and availability at a low level. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting privileges and user interactions with the affected widgets and monitor for suspicious activity related to widget usage.