This vulnerability in CreativeMindsSolutions CM Pop-Up banners (<= 1.7.6) allows reflected cross-site scripting due to improper input neutralization during web page generation. An attacker can craft malicious input that is reflected in the web page without proper sanitization, potentially executing arbitrary scripts in the victim's browser. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. The reflected nature requires user interaction to trigger the vulnerability.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisories for updates and consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts as a temporary mitigation. Avoid clicking on suspicious links that could trigger the reflected XSS until a fix is released.