This vulnerability in WP Codeus WP Proposals (<= 2.3) involves improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). An attacker with high privileges and requiring user interaction can exploit this to execute arbitrary scripts in the context of affected users. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability to a limited extent. No vendor advisory or patch information is currently available.

Successful exploitation can lead to limited confidentiality, integrity, and availability impacts due to stored XSS. This may allow attackers to execute scripts in the context of other users, potentially leading to session hijacking, defacement, or other malicious actions. However, exploitation requires high privileges and user interaction, which reduces the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to the plugin to trusted users only and consider disabling or restricting the affected functionality to reduce exposure.