The AppJetty Show All Comments plugin versions up to 7.0.1 contain a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows attackers with high privileges to inject malicious scripts that execute when other users view the affected page. The vulnerability has a CVSS 3.1 score of 5.9, reflecting medium severity with impacts on confidentiality, integrity, and availability. Exploitation requires user interaction and elevated privileges. No patch or official fix details are currently available.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in limited confidentiality, integrity, and availability impacts. The attack requires high privileges and user interaction, which reduces the likelihood of widespread exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and exercise caution with user-generated content in the Show All Comments plugin. Monitor vendor communications for updates on patches or official mitigations.