The softnwords SMM API versions up to 6.0.31 contain a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with low privileges and requiring user interaction to inject malicious scripts that can compromise confidentiality, integrity, and availability of affected systems. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, and user interaction needed, with scope changed and partial impacts on confidentiality, integrity, and availability. No patch or official remediation information is provided in the available data.

Successful exploitation of this stored XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. Attackers may execute malicious scripts in the context of affected users, potentially leading to session hijacking, data manipulation, or denial of service. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation and output encoding controls on the affected API endpoints to mitigate stored XSS risks. Monitor vendor channels for updates regarding patches or official mitigations.