The Skyword API Plugin versions up to 2.5.3 suffer from a stored cross-site scripting vulnerability caused by improper input neutralization during web page generation. This allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can affect confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and scope change.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The scope of impact extends beyond the vulnerable component, affecting the broader system environment. However, no active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting user privileges and minimizing user interaction with untrusted inputs in the affected plugin. Monitor vendor channels for updates and apply patches promptly once released.