The FastSpring plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper neutralization of input in the 'color' attribute of a specific block. This allows authenticated contributors or higher to inject arbitrary JavaScript that executes in the context of users viewing the injected content. The vulnerability affects all versions up to and including 3.0.1. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges, no user interaction, with scope changed and low impact on confidentiality and integrity, and no impact on availability.

Successful exploitation allows an authenticated user with contributor-level privileges or higher to inject malicious scripts into pages using the vulnerable block. These scripts execute in the browsers of users who view the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability and has limited impact on confidentiality and integrity according to the CVSS vector.

Patch status is not yet confirmed — no official fix or patch information is currently available. Until a vendor advisory or patch is released, it is recommended to restrict contributor-level access carefully and monitor for suspicious activity related to the vulnerable plugin block. Check the vendor's official channels regularly for updates or patches addressing this vulnerability.