This vulnerability in MX Time Zone Clocks (<= 5.1.1) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker with low privileges and requiring user interaction could exploit this to execute arbitrary scripts in the context of affected users. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, and user interaction needed, with partial impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing the affected web pages, potentially leading to partial confidentiality, integrity, and availability impacts. However, the impact is limited as indicated by the medium severity score and the requirement for user interaction and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from Maksym Marko regarding this vulnerability. Until a fix is available, cautious handling of user input and limiting exposure to untrusted inputs may reduce risk.