This vulnerability in Tim Berneman Dynamic "To Top" plugin (up to version 3.5.2) involves improper neutralization of input during web page generation, resulting in a Stored Cross-site Scripting (XSS) flaw. An attacker with high privileges and requiring user interaction could inject malicious scripts that execute in the context of other users. The CVSS 3.1 base score is 5.9, indicating medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed. The vulnerability impacts confidentiality, integrity, and availability to a limited extent.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute when other users view affected pages. This can lead to limited confidentiality, integrity, and availability impacts such as session hijacking, defacement, or denial of service. However, exploitation requires user interaction and high privileges, reducing the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high privilege access to the plugin and avoid exposing it to untrusted users. Monitor vendor channels for updates or official patches addressing this vulnerability.