This vulnerability in Penci Shortcodes & Performance arises from improper input neutralization during web page generation, leading to DOM-based XSS. The flaw allows an attacker with low privileges and requiring user interaction to execute malicious scripts in the context of the affected web application. The CVSS score is 6.5 (medium), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality, integrity, and availability. The affected versions are up to 6.1. No known exploits in the wild or patch information is provided.

Successful exploitation can lead to partial disclosure of information, modification of data, and disruption of service within the affected application context. The attack requires user interaction and low privileges, limiting the scope but still posing a risk to users of the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure by restricting privileges and user interactions where possible. Monitor vendor communications for updates on patches or official mitigations.