This vulnerability in iamapinan PDPA Consent for Thailand (versions <= 1.1.1) is due to improper neutralization of input during web page generation, resulting in a Stored Cross-site Scripting (XSS) flaw. The CVSS 3.1 base score is 5.9, reflecting network attack vector, low attack complexity, high privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability at a low level. The issue allows an attacker with high privileges to inject malicious scripts that persist and execute when viewed by other users. No patch or official fix information is currently provided.

Successful exploitation could lead to execution of arbitrary scripts in the context of affected users, potentially resulting in limited confidentiality, integrity, and availability impacts. The attacker must have high privileges and rely on user interaction to trigger the exploit. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit high privilege access to the affected application and exercise caution with user interactions involving the PDPA Consent interface. Monitor vendor channels for updates regarding patches or official mitigations.