This vulnerability in Wappointment allows an attacker with at least low privileges and requiring user interaction to inject and store malicious scripts due to improper input sanitization during web page generation. Successful exploitation can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The issue affects all versions through 2.6.9. No vendor advisory or patch links are provided, and it is not a cloud service, so remediation depends on vendor updates.

Exploitation of this stored XSS vulnerability can allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to partial compromise of user data confidentiality, integrity, and availability. The CVSS score of 6.5 reflects a medium impact, with the requirement of low privileges and user interaction limiting the ease of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is currently documented, users should monitor for vendor updates addressing this vulnerability. Until a fix is available, consider restricting user input or applying web application firewall (WAF) rules to detect and block suspicious input patterns related to XSS.