This vulnerability in Israpil Textmetrics (versions up to 3.6.5) arises from improper neutralization of script-related HTML tags, enabling basic cross-site scripting (XSS) attacks. An attacker with low privileges can inject code into web pages served by the application without requiring user interaction. The CVSS 3.1 base score is 4.3, reflecting limited impact primarily on confidentiality. No official patch or vendor advisory is provided, and no known exploits have been observed.

The vulnerability allows an attacker with low privileges to inject script code into web pages, potentially leading to limited confidentiality impact. There is no impact on integrity or availability according to the CVSS vector. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation or output encoding controls to mitigate script injection risks in affected versions.