This vulnerability involves improper input sanitization in the Google Earth Embed plugin by Andrew Norcross, leading to stored cross-site scripting (XSS). An attacker could inject malicious scripts that are stored and later executed in the context of the affected web application. The vulnerability affects versions up to 1.0. The CVSS vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser within the context of the vulnerable application. This may lead to information disclosure, session hijacking, or other impacts typical of stored XSS vulnerabilities. The CVSS score of 6.5 reflects a medium impact, with partial compromise of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from the vendor. Until a fix is available, consider applying input validation or output encoding as a temporary mitigation if possible.