This vulnerability in scripteo Ads Pro (ap-plugin-scripteo) allows stored cross-site scripting due to improper input neutralization during web page generation. Affected versions include all releases up to 5.0. The CVSS 3.1 score of 6.5 reflects that an attacker with low privileges can remotely exploit this vulnerability if a user interacts with a crafted payload, potentially leading to partial confidentiality, integrity, and availability impacts. No patch or official remediation guidance is currently available.

Successful exploitation can lead to stored XSS attacks, enabling attackers to execute arbitrary scripts in the context of affected users. This can compromise confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. However, exploitation requires user interaction and low privilege access, limiting the overall impact severity to medium. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block XSS payloads. Monitor vendor channels for updates and apply patches promptly once available.