This vulnerability in the gopiplus Image horizontal reel scroll slideshow plugin allows stored XSS due to improper input neutralization during web page generation. It affects all versions up to 13.4. The CVSS vector indicates the attack requires network access, low attack complexity, high privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to medium. No vendor advisory or patch links are available, and the plugin is not a cloud service.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of users viewing the affected web pages, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and high privileges, which reduces the overall risk. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin to trusted users only and consider disabling or removing the plugin if feasible. Monitor vendor channels for updates or patches addressing this vulnerability.