This vulnerability in wpcraft WooMS (<= 9.12) involves improper input neutralization during web page generation, resulting in stored cross-site scripting (XSS). An attacker with high privileges and requiring user interaction can exploit this to inject malicious scripts that may affect confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, high privileges required, user interaction needed, and partial impacts on confidentiality, integrity, and availability.

Exploitation could allow an attacker with high privileges to execute stored malicious scripts in the context of other users, potentially leading to limited data disclosure, modification, or disruption of service. The impact is rated medium based on the CVSS score and vector, with no known exploits in the wild reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit high privilege user access and exercise caution with user-generated content. Monitor vendor channels for updates and apply patches promptly once available.