This vulnerability in devscred ShopCred involves improper neutralization of input during web page generation, leading to a DOM-based XSS issue. It affects ShopCred versions up to 1.3.0. The CVSS 3.1 base score is 6.5, with an attack vector of network, low attack complexity, requiring low privileges and user interaction, and impacts on confidentiality, integrity, and availability classified as low. No official patch or remediation information is provided, and no known exploits are reported in the wild. The product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to limited disclosure or modification of data and partial disruption of service. The impact is rated medium due to the requirement of user interaction and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, applying input validation and output encoding best practices on the affected application may reduce risk.