The timmcdaniels Media Category Library versions up to 2.7 contain a reflected XSS vulnerability due to improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute when a user views a crafted page, potentially leading to information disclosure, modification, or disruption of service. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal user data, manipulate content, or disrupt service. The CVSS score indicates partial impacts on confidentiality, integrity, and availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider applying input validation or output encoding workarounds if feasible.