This vulnerability in WP Airdrop Manager (versions ≤ 1.0.5) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with high privileges can inject malicious scripts that execute when other users view the affected content. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges are high, user interaction is required, and the scope is changed with low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the browsers of users who view the affected pages, potentially leading to data disclosure, modification, or disruption of service. The impact is rated medium based on the CVSS score and vector, reflecting limited but non-negligible consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access to trusted individuals and monitor for suspicious activity related to the plugin. Avoid exposing the affected plugin to untrusted users. Do not rely on generic mitigations unless specifically recommended by the vendor.