This vulnerability in sakurapixel Lunar (up to version 1.3.0) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker could inject malicious scripts that are stored by the application and executed in the context of other users' browsers, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction needed, and a scope change with low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute malicious scripts in other users' browsers. This may lead to limited disclosure of information, modification of data, or disruption of service within the scope of the affected application. However, the impact is rated medium due to the conditions required for exploitation and the limited scope of impact.

No patch or official remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should exercise caution with input handling and consider implementing web application firewall rules or input sanitization as temporary mitigations.