The JonathanMH Append Link on Copy plugin, versions up to 0.2, contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows an attacker with high privileges to inject malicious scripts that execute when other users interact with the affected content. The CVSS 3.1 base score is 5.9, reflecting network attack vector, low attack complexity, high privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability at a low to medium level. No patch or official remediation information is currently available.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject persistent malicious scripts, potentially leading to limited confidentiality, integrity, and availability impacts within the affected environment. However, exploitation requires user interaction and elevated privileges, which reduces the overall risk. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access to the plugin and limit user interactions that could trigger the vulnerability. Monitor for updates from the vendor regarding patches or mitigations.