This vulnerability in grimdonkey Magic the Gathering Card Tooltips (<= 3.4.0) involves improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). An attacker could inject malicious scripts that are stored and later executed in the context of users visiting affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impact on confidentiality, integrity, and availability rated as low to low to low respectively, combined with scope change.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to data disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. However, the impact is rated medium severity with low to medium impact metrics and no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates. Until a fix is available, consider restricting privileges and limiting user interaction to reduce risk.