This vulnerability involves improper input sanitization in the Terms Popup On User Login plugin, which allows an attacker with appropriate privileges to inject and store malicious scripts that execute when other users view the affected web page. The issue affects all versions up to 2.0.8. The CVSS vector indicates the attack requires network access, low complexity, privileges, and user interaction, with potential impacts on confidentiality, integrity, and availability. No patch or official remediation information is provided in the available data.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to limited data disclosure, modification, or disruption of service. The medium CVSS score reflects these impacts but also the requirement for privileges and user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict privileges to trusted users and consider disabling or limiting use of the affected plugin. Monitor vendor communications for updates on patches or mitigations.