This vulnerability in Nelio Popups (<= 1.3.0) involves improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). An attacker with low privileges can inject malicious scripts that execute when a user interacts with the affected web page, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and a scope change with partial impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. The attack requires user interaction and low privileges, limiting the ease of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider restricting user input that can be rendered by Nelio Popups or applying web application firewall (WAF) rules to detect and block XSS payloads. Monitor vendor channels for updates and apply official patches promptly once released.