The Themepoints Skill Bar plugin versions up to 1.2 contain a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers with at least low privileges and requiring user interaction to inject malicious scripts that can compromise confidentiality, integrity, and availability to a limited extent. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, privileges required, user interaction, and partial impact on confidentiality, integrity, and availability. No patch or official fix information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The impact is limited by the need for user interaction and some privileges, and the overall severity is medium. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin features to trusted users and monitor for suspicious activity related to script injection. Avoid using affected versions if possible.