This vulnerability in purethemes Listeo Core is a reflected Cross-site Scripting (XSS) issue caused by improper input neutralization during web page generation. It affects all versions before 2.0.19. An attacker can craft malicious input that, when reflected in the web page, executes arbitrary scripts in the victim's browser session. The CVSS 3.1 vector indicates it is remotely exploitable over the network without privileges but requires user interaction. The impact includes partial loss of confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the data, and no known exploits have been reported.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of session tokens, defacement, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS score of 7.1 reflects high severity with partial impact on all three security properties. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or advisory is provided in the available data, users should monitor purethemes communications for updates. Until a patch is available, consider applying web application firewall (WAF) rules to detect and block reflected XSS payloads and educate users to avoid clicking suspicious links that could trigger the vulnerability.