This vulnerability in EnvoThemes Envo Extra (<= 1.9.11) involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker with low privileges can inject malicious scripts that execute in the context of other users, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and partial impact on confidentiality, integrity, and availability. No known exploits in the wild or patch information is currently available.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially allowing data disclosure, modification, or disruption of service. The impact is limited by the requirement for attacker privileges and user interaction. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, limit privileges of users who can input data into the affected plugin and consider disabling or restricting use of the Envo Extra plugin if feasible. Monitor vendor channels for updates.