This vulnerability in mdempfle Advanced iFrame allows an attacker to inject malicious scripts via improperly sanitized input that is used during web page generation, resulting in DOM-based XSS. The affected versions include all versions up to 2025.10. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, low privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low to low respectively, resulting in an overall medium severity score of 6.5.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. However, the impact is rated medium, indicating limited but non-negligible consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider applying input validation or sanitization controls at the application level if feasible.