The podspod AppReview application versions up to 0.2.9 contain a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers to inject malicious scripts that execute in users' browsers when they interact with crafted URLs or inputs. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope change, and low impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure, session hijacking, or other user-impacting actions. The impact is rated as high severity but with low confidentiality, integrity, and availability impacts individually. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is provided in the available data. Until a fix is available, users should exercise caution when interacting with untrusted inputs or URLs related to the AppReview application.