This vulnerability in bPlugins LightBox Block (up to version 1.1.30) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker can inject malicious scripts that persist and execute when other users access the affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low to low respectively, resulting in an overall medium severity score of 6.5.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing the affected LightBox Block content. This may lead to information disclosure, modification of content, or disruption of availability for those users. The impact is limited by the requirement for attacker privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the affected LightBox Block plugin versions. Monitor vendor channels for updates and apply patches promptly once released.