The MorganF Weather Layer product suffers from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with high privileges and requiring user interaction to inject malicious scripts that persist and execute in the context of other users. The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, low attack complexity, and partial impacts on confidentiality, integrity, and availability. Affected versions include all up to 4.2.1. No patch or official remediation information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to partial disclosure of information, modification of data, or disruption of service. The attack requires high privileges and user interaction, which limits the ease of exploitation. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider applying web application firewalls or other input filtering mechanisms to mitigate risk. Monitor vendor communications for updates on patches or official mitigations.