The wpsoul GreenCon plugin versions up to 1.0.1 contain a stored cross-site scripting vulnerability due to improper input sanitization during web page generation. This allows attackers with at least low privileges and requiring user interaction to inject malicious scripts that can execute in a victim's browser, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and scope change.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of affected users' sessions or data within the context of the GreenCon plugin. The attacker could execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or other malicious actions. However, exploitation requires user interaction and some privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to trusted users only and monitor for suspicious activity related to the plugin. Avoid exposing the plugin to untrusted users where possible.