The ecoal95 EC Stars Rating plugin versions up to 1.0.11 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with high privileges to inject malicious scripts that are stored and later executed in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction needed, and a scope change with partial impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of malicious scripts in users' browsers, potentially resulting in data disclosure, data manipulation, or denial of service within the scope of the affected application. The impact is limited to confidentiality, integrity, and availability with low to medium severity. Exploitation requires high privileges and user interaction, reducing the likelihood of widespread impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access and validate or sanitize inputs manually where possible to reduce risk. Monitor for updates from the vendor regarding patches or official mitigations.