The Jake Group WP Less Compiler plugin versions up to 1.3.0 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers to inject malicious scripts that persist and execute when users access the affected content. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing the affected pages, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates and apply any official patches once released. Until then, consider restricting user input or employing web application firewalls to mitigate potential exploitation.