This vulnerability in PluginOps Landing Page Builder arises from improper input neutralization during the generation of web pages, specifically in the page-builder-add feature. It allows stored cross-site scripting (XSS), where malicious scripts can be injected and persistently stored, potentially executed in the context of users who view the affected pages. The CVSS 3.1 score is 5.9 (medium), reflecting network attack vector, low attack complexity, high privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability at a low level. The affected versions include all up to and including 1.5.3.4. There is no vendor advisory or patch information available at this time.

Successful exploitation can result in stored XSS attacks, which may allow attackers to execute arbitrary scripts in the context of users viewing the compromised pages. This can lead to limited disclosure of information, modification of data, and disruption of availability. The attack requires high privileges and user interaction, limiting the ease of exploitation. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider applying input validation or sanitization at the application level if feasible. Monitor vendor channels for updates or patches addressing this vulnerability.