The ExpertBusinessSearch Local Search SEO Contact Page plugin versions up to 4.0.1 contain a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with at least low privileges and requiring user interaction to inject malicious scripts that execute in the context of other users, potentially leading to partial data disclosure, modification, or service disruption. The CVSS vector indicates network attack vector, low attack complexity, privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in partial compromise of confidentiality, integrity, and availability of affected systems. Attackers may execute arbitrary scripts in the context of other users, potentially leading to data theft, unauthorized actions, or service disruption. However, exploitation requires user interaction and some level of privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin and monitoring for suspicious activity related to input handling on the contact page. Avoid relying on this plugin in sensitive environments until patched.