This vulnerability in straps Strx Magic Floating Sidebar Maker (<= 1.4.1) is due to improper neutralization of input during web page generation, resulting in a Stored Cross-site Scripting (XSS) issue. An attacker can inject malicious scripts that persist and execute when other users view the affected pages. The CVSS score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of other users, potentially leading to theft of user credentials, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability to a limited extent. The scope is changed, indicating the vulnerability affects components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider limiting exposure by restricting user input or applying web application firewall rules to detect and block XSS payloads if feasible.