This vulnerability is a persistent XSS in NodeBB v3.11.0, where attackers can inject and store malicious scripts in the 'about me' profile section. When other users access the profile, the stored script may execute in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability requires attacker privileges to edit their profile and user interaction to trigger the script. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

The vulnerability allows an attacker with profile editing privileges to inject persistent malicious scripts that execute in the context of other users viewing the profile. This can lead to limited confidentiality and integrity impacts such as theft of user session tokens or manipulation of displayed content. Availability is not affected. The overall impact is rated as medium severity with a CVSS score of 4.6.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting profile editing permissions or sanitizing user input in the 'about me' section as a temporary mitigation.