This vulnerability in Luke America WCS QR Code Generator (<= 1.0) involves improper input sanitization leading to stored cross-site scripting (XSS). An attacker can inject malicious scripts that are stored and later executed when users access the affected web pages. The CVSS 3.1 vector indicates the attack requires network access, low complexity, privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low and low respectively.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to information disclosure, modification of data, or disruption of service. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS score. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is referenced, users should monitor Luke America communications for updates. In the meantime, applying input validation and output encoding on user-supplied data may help mitigate risk. No vendor advisory indicates that the issue is already mitigated or requires no action.