This vulnerability in the Fitness Park plugin by sparklewpthemes is a DOM-based Cross-site Scripting issue caused by improper input neutralization during web page generation. It affects all versions up to 1.1.1. The CVSS score of 6.5 reflects that the vulnerability can be exploited remotely over the network with low attack complexity, requiring some user interaction and privileges. Successful exploitation could lead to partial compromise of confidentiality, integrity, and availability of the affected system. No patch or official remediation guidance is currently provided, and no known exploits have been reported.

Exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of sensitive information, modification of data, or disruption of service. The CVSS vector indicates limited confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and some privileges, reducing the overall risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor for updates from sparklewpthemes. Until a fix is released, consider applying web application firewall (WAF) rules to detect and block suspicious input patterns related to DOM-based XSS. Avoid exposing the vulnerable plugin on publicly accessible sites if possible.