This vulnerability involves improper input neutralization in the Thomas Maier Image Source Control plugin, leading to reflected cross-site scripting (XSS). It affects all versions up to 2.29.0. The issue allows an attacker to inject malicious scripts that are reflected back to the user, potentially enabling session hijacking or other script-based attacks. No CVSS score or vendor patch information is provided, and no known exploits have been reported. The plugin is not a cloud service, so remediation depends on vendor updates.

The vulnerability enables reflected XSS attacks, which can lead to execution of arbitrary scripts in the context of a victim's browser session. This may result in session hijacking, defacement, or other client-side impacts. There is no information about exploitation in the wild or additional impacts such as privilege escalation or data breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or output encoding workarounds if feasible. Monitor official Thomas Maier channels for updates. No vendor advisory or official fix is currently documented.