The Wolfgang Include Mastodon Feed plugin suffers from a DOM-based Cross-site Scripting vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 1.9.9. The vulnerability allows an attacker with low complexity and limited privileges, requiring user interaction, to potentially execute arbitrary scripts, impacting confidentiality, integrity, and availability to a limited extent. The CVSS score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, partial privileges required, user interaction needed, and partial impact on confidentiality, integrity, and availability.

Successful exploitation could lead to execution of malicious scripts in the victim's browser, potentially resulting in information disclosure, modification of web content, or disruption of application availability. The impact is limited by the need for user interaction and the requirement of some privileges. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting privileges and minimizing exposure to untrusted input in the Include Mastodon Feed plugin. Monitor vendor channels for updates and apply patches promptly once available.