This vulnerability in ONTRAPORT PilotPress (<= 2.0.36) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker could inject malicious scripts that persist and execute when other users access the affected content. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, requiring low privileges and user interaction, and impacts confidentiality, integrity, and availability. No patch or official fix information is currently provided, and no known exploits have been observed.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to data disclosure, modification, or denial of service. The CVSS score of 6.5 reflects medium severity with partial impact on confidentiality, integrity, and availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting exposure by restricting access to affected functionality and applying web application firewall (WAF) rules to detect and block XSS payloads. Monitor official ONTRAPORT communications for updates and apply patches promptly once released.