This vulnerability in kcseopro AdWords Conversion Tracking Code (versions <= 1.0) is a Stored Cross-site Scripting (XSS) issue caused by improper neutralization of input during web page generation. An attacker with low privileges and requiring user interaction could exploit this to execute arbitrary scripts, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5, reflecting medium severity with network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability. No patch or vendor advisory information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The impact is limited by the requirement for user interaction and low privileges. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting user privileges and educating users to avoid interacting with untrusted content related to this plugin. Monitor vendor channels for updates or official patches.