This vulnerability in Tan Nguyen Instant Locations (<= 1.0) involves improper neutralization of input during web page generation, resulting in a stored cross-site scripting (XSS) flaw. An attacker could inject malicious scripts that persist on the affected application, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute arbitrary scripts in the context of the affected web application. This may lead to limited confidentiality and integrity impacts as well as some availability degradation. However, no known exploits have been reported, and the overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit exposure by restricting high privilege access and exercising caution with user input handling. Monitor vendor channels for updates regarding patches or official mitigations.