This vulnerability in the xtreeme Planyo online reservation system allows an attacker with limited privileges to inject and store malicious scripts due to improper input sanitization during web page generation. When other users access the affected pages, the stored scripts may execute, potentially leading to partial confidentiality, integrity, and availability impacts as reflected by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The issue affects versions up to 3.1 and is classified as a stored XSS vulnerability.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially resulting in partial compromise of confidentiality, integrity, and availability of the system or user data. The vulnerability requires user interaction and limited privileges to exploit. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should apply strict input validation and output encoding as a temporary mitigation. Monitor vendor communications for official fixes.