This vulnerability involves improper neutralization of input in the sureshdsk Bootstrap collapse component, resulting in a Stored Cross-site Scripting (XSS) flaw. Versions up to 1.0.4 are affected. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes partial loss of confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability allows an attacker to inject and store malicious scripts that execute in the context of users' browsers when they access affected web pages. This can lead to unauthorized actions such as data theft, session hijacking, or disruption of service, impacting confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and output encoding controls on their own implementations of the affected component to mitigate stored XSS risks. Monitor vendor channels for updates and patches.