Jthemes xSmart versions up to 1.2.9.4 contain a basic cross-site scripting (XSS) vulnerability due to improper neutralization of script-related HTML tags in web pages. This flaw allows an attacker with low privileges to inject script code, potentially leading to limited confidentiality impact. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and limited confidentiality impact. No official patch or vendor advisory is currently provided, and no known exploits have been reported.

The vulnerability allows low-privileged attackers to inject script code in affected web pages, potentially leading to limited confidentiality impact such as information disclosure. There is no impact on integrity or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates regarding patches or official mitigations.