This vulnerability in Broadstreet Ads (<= 1.51.2) is a stored cross-site scripting issue caused by improper input neutralization during web page generation. An attacker with low privileges can inject malicious scripts that are stored and later executed in the context of other users' browsers, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 score of 6.5 reflects medium severity with network attack vector, low attack complexity, and required user interaction. No patch or official remediation guidance is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing affected Broadstreet Ads pages, potentially leading to limited data disclosure, modification, or disruption of service. The impact is rated medium due to the combination of attack complexity, required privileges, and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud service, remediation depends on vendor patch releases. Users should follow Broadstreet's official channels for updates and apply patches promptly once available. Until then, consider restricting user input or sanitizing inputs at the application level as a temporary mitigation if feasible.