This vulnerability in DBAR Productions Volunteer Sign Up Sheets (versions before 5.5.5) involves improper neutralization of input during web page generation, resulting in stored Cross-site Scripting (XSS). An attacker with high privileges and requiring user interaction can inject malicious scripts that execute in the context of other users, potentially affecting confidentiality, integrity, and availability. The CVSS 3.1 base score is 5.9, reflecting medium severity with network attack vector, low attack complexity, and requiring privileges and user interaction.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially allowing disclosure of sensitive information, modification of data, or disruption of service. The impact is limited to confidentiality, integrity, and availability with low to medium severity as per the CVSS score. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, users should monitor for updates from DBAR Productions and apply any future patches promptly. Until then, restricting high privilege user input and applying web application firewall rules to detect and block XSS payloads may help mitigate risk.