The Inboxify Sign Up Form up to version 1.0.4 suffers from a stored cross-site scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that persist and execute in the context of other users viewing the affected pages. The CVSS 3.1 base score is 5.9 (medium), with network attack vector, low attack complexity, requiring high privileges and user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject persistent malicious scripts into the sign-up form, potentially leading to unauthorized actions, data disclosure, or disruption of service for users interacting with the affected pages. The impact affects confidentiality, integrity, and availability but requires user interaction and high privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict high privilege user access to the sign-up form and apply input validation or sanitization controls where possible to mitigate stored XSS risks.