This vulnerability involves improper neutralization of input in the Mortgage Calculator BMI Adult & Kid Calculator, leading to stored cross-site scripting (XSS). The affected versions are up to 1.2.2. An attacker with high privileges and the ability to trick a user into interacting with malicious content could exploit this to execute arbitrary scripts in the context of the affected application. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with limited impact on confidentiality, integrity, and availability.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires high privileges and user interaction, which reduces the overall risk. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should limit exposure by restricting high privilege access and exercising caution with user-generated content. Monitor vendor communications for updates on remediation.