This vulnerability in ttttonyhe OBlog involves improper processing of the 'day' parameter in the /tags.php file, leading to cross-site scripting (XSS). An attacker can exploit this remotely by injecting malicious scripts, potentially impacting users who visit the affected pages. The software uses a rolling release model, and no specific version information is provided for affected or patched releases. The vendor did not respond to the disclosure, and no official remediation or patch information is available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on integrity.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability does not affect confidentiality or availability according to the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is published, users should monitor official channels for updates. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block malicious input targeting the 'day' parameter in /tags.php.