This vulnerability in the Aman Popup addon for Ninja Forms is due to improper input sanitization when generating web pages, leading to stored cross-site scripting (XSS). Attackers could inject malicious scripts that persist in the application and execute when viewed by users with privileges, potentially impacting confidentiality, integrity, and availability to a limited extent. The vulnerability affects all versions up to 3.5.1. No patch or official remediation details are provided in the available data.

Successful exploitation could allow an attacker with high privileges and user interaction to execute arbitrary scripts in the context of affected users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and scope changed, with partial impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure by restricting access to the affected plugin and monitoring for suspicious activity related to stored XSS. Avoid using untrusted input in the popup addon and apply any recommended security configurations from the vendor once available.