This vulnerability in MDC YouTube Downloader (<= 3.0.0) arises from improper neutralization of input during web page generation, leading to DOM-based Cross-site Scripting (XSS). An attacker with low privileges and requiring user interaction can exploit this to execute arbitrary scripts in the context of the victim's browser, potentially affecting confidentiality, integrity, and availability. The CVSS score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, and user interaction. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation can lead to execution of malicious scripts in the user's browser, potentially allowing theft of sensitive information, session hijacking, or other client-side impacts. The vulnerability affects confidentiality, integrity, and availability at a limited level. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using untrusted input within MDC YouTube Downloader and consider restricting access to trusted users only. Monitor official channels for updates and apply patches promptly once released.