This vulnerability involves improper input sanitization in the Include Me plugin by Stefano Lissa, which allows an attacker with high privileges and requiring user interaction to inject stored malicious scripts into web pages generated by the application. The vulnerability affects all versions up to 1.3.2. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability at a low level.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, and limited disruption of service. However, exploitation requires high privileges and user interaction, which limits the ease of attack. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to trusted users with high privileges and be cautious of user inputs that could be stored and rendered. Monitor vendor channels for updates regarding patches or official mitigations.