This vulnerability in AyeCode Ketchup Shortcodes (<= 0.1.2) arises from improper neutralization of script-related HTML tags, leading to stored cross-site scripting (XSS). An attacker with low privileges and requiring user interaction can exploit this to execute arbitrary script code within the affected web application context. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, limited privileges required, user interaction needed, and partial impact on confidentiality, integrity, and availability.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The impact is rated medium severity with partial loss of confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting privileges of users who can submit content and apply web application firewall (WAF) rules to detect and block malicious script payloads related to this vulnerability. Monitor vendor channels for updates and patches.