This vulnerability in alordiel Dropdown Multisite selector (versions before 0.9.4) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker could inject malicious scripts that persist and execute when other users access the affected functionality. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and partial impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to information disclosure, modification of data, or disruption of service. The medium severity reflects these impacts but also the requirement for some privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting access to the affected plugin or applying input validation and output encoding controls where possible to mitigate stored XSS risks.