This vulnerability in PenciDesign Penci Review plugin (versions <= 3.5) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with low privileges and requiring user interaction can inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 6.5, reflecting medium severity. No patch or official remediation guidance is currently available from the vendor or other sources.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users viewing affected pages, potentially leading to limited data disclosure, modification, or disruption of availability. The vulnerability requires low privileges and user interaction, and the impact is limited to confidentiality, integrity, and availability as per the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting privileges for users who can submit content, and apply web application firewall (WAF) rules to detect and block suspicious input patterns related to XSS. Monitor vendor channels for updates and apply patches promptly once released.