This vulnerability in sharkthemes Smart Related Products plugin (up to version 2.0.8) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker could inject malicious scripts that are stored and later executed in the context of users viewing the affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability at a low to medium level.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to data disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS score of 5.9 reflects a medium severity impact. No known exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or restricting the use of the affected plugin version. Monitor official sharkthemes communications for updates and apply any official fixes once released.