This vulnerability in Google Drive WP Media plugin (up to version 2.4.4) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with low privileges can inject malicious scripts that execute in the context of other users, potentially impacting confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope changed, with low impact on confidentiality and integrity and low impact on availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to information disclosure, session hijacking, or other impacts on user data and application integrity. The CVSS score of 6.5 reflects a medium severity impact with partial loss of confidentiality, integrity, and availability.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor's advisory channels for updates and apply any official fixes once available. Until then, limit privileges of users who can input data into the plugin and exercise caution with user-generated content to reduce risk.