This vulnerability in OTWthemes Widgetize Pages Light plugin (<= 3.0) involves improper neutralization of input during web page generation, leading to Stored Cross-site Scripting (XSS). The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, low attack complexity, requiring high privileges and user interaction, and impacts on confidentiality, integrity, and availability. The vulnerability allows an attacker with high privileges to inject malicious scripts that persist in the application, potentially affecting users who view the compromised pages.

Successful exploitation could lead to execution of arbitrary scripts in the context of affected users, potentially resulting in partial loss of confidentiality, integrity, and availability of the affected system. However, exploitation requires high privileges and user interaction, which limits the attack scope. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to the affected plugin and monitor for suspicious activity. Avoid enabling or using the vulnerable versions of Widgetize Pages Light where possible.