This vulnerability in Jennifer Moss MWW Disclaimer Buttons (<= 3.41) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker with high privileges and requiring user interaction could inject malicious scripts that execute in the context of affected users, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and scope changed.

Successful exploitation can lead to limited confidentiality, integrity, and availability impacts due to stored XSS. An attacker could execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other malicious actions. However, exploitation requires high privileges and user interaction, which reduces the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin to trusted users only and monitor for suspicious activity. Avoid using affected versions of MWW Disclaimer Buttons if possible.