This vulnerability in the salubrio Add Code To Head plugin allows stored XSS due to improper input neutralization during web page generation. It affects versions up to 1.17 and requires high privileges and user interaction to exploit. The CVSS 3.1 base score is 5.9, indicating medium severity, with impact on confidentiality, integrity, and availability rated as low to low to low respectively. No patch or official remediation guidance is currently provided, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and elevated privileges, which reduces the overall risk level. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin to trusted users only and monitor for suspicious activity related to script injection. Avoid granting unnecessary high privileges to users who can modify plugin settings or content.