This vulnerability involves improper neutralization of input during web page generation in the shalomworld SW Plus product, leading to a reflected cross-site scripting (XSS) issue. Reflected XSS vulnerabilities occur when untrusted input is included in web responses without proper sanitization, enabling attackers to execute arbitrary scripts in the context of the victim's browser. The affected component is the shalom-world-media-gallery within SW Plus versions up to 2.1. The CVSS vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited degree. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of a victim's browser session when they interact with a crafted link or input. This may lead to limited confidentiality, integrity, and availability impacts such as theft of session tokens, defacement, or redirection to malicious sites. However, no known exploits have been reported in the wild, and the overall impact is rated high based on the CVSS score of 7.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted inputs or links related to the affected product. Implementing web application firewall (WAF) rules to detect and block reflected XSS payloads may provide temporary mitigation. Avoiding user interaction with suspicious URLs can reduce risk.