This vulnerability in kcseopro's AdWords Conversion Tracking Code plugin allows stored XSS due to improper input neutralization during web page generation. The CVSS 3.1 score is 6.5 (medium), reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. The affected versions include all up to 1.0. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation could allow an attacker with low privileges to inject malicious scripts that execute in the context of users viewing the affected web pages, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system or user data. The requirement for user interaction and low privileges reduces the overall risk but does not eliminate it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider restricting access to trusted users and monitoring for suspicious input or behavior related to the affected plugin. Avoid exposing the vulnerable plugin in environments where untrusted users can inject content.