The ken107 SiteNarrator Text-to-Speech Widget contains a stored cross-site scripting vulnerability caused by improper neutralization of input during web page generation. This flaw affects versions up to and including 1.9. The vulnerability allows an attacker with high privileges and requiring user interaction to inject malicious scripts that can compromise confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 5.9, indicating medium severity. No patch or mitigation details are currently provided by the vendor.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in data disclosure, modification, or disruption of service. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability at a low level. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting high-privilege access to the widget and limit user interactions that could trigger the vulnerability. Monitor vendor communications for updates on patches or official mitigations.