The SnapWidget Social Photo Feed Widget version 1.1.0 and earlier contains a DOM-based cross-site scripting vulnerability caused by improper neutralization of input during web page generation. This allows an attacker with low privileges and requiring user interaction to execute malicious scripts in the context of the affected web page, potentially impacting confidentiality, integrity, and availability. The CVSS v3.1 base score is 6.5, reflecting medium severity with network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to information disclosure, modification of web content, or disruption of service. The impact is limited to the affected widget and requires user interaction and some privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround information is currently available. Users should monitor vendor communications for updates and consider restricting widget usage or applying input sanitization if possible.