This vulnerability in Stachethemes Advanced Event Manager (<= 1.1.6) involves improper input neutralization during web page generation, leading to stored cross-site scripting (XSS). An attacker could inject malicious scripts that persist and execute when other users access the affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low to low respectively but combined to a medium overall severity. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, session hijacking, or other impacts on user data and application integrity. The CVSS score of 6.5 reflects a medium severity with possible impacts on confidentiality, integrity, and availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying input validation or output encoding workarounds if feasible. Monitor official Stachethemes channels for updates regarding patches or mitigations.