This vulnerability in wpo-HR NGG Smart Image Search (<= 3.4.3) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with low privileges and requiring user interaction can exploit this to execute arbitrary scripts, potentially affecting the confidentiality, integrity, and availability of the affected system. The vulnerability is network exploitable and has a CVSS 3.1 base score of 6.5.

Successful exploitation could lead to execution of malicious scripts in the context of the affected application, potentially allowing an attacker to steal sensitive information, modify data, or disrupt service. The impact affects confidentiality, integrity, and availability but is limited by the requirement for low privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input that can be rendered by the plugin and apply web application firewall (WAF) rules to detect and block XSS payloads specific to this plugin.