This vulnerability in PublishPress Series (up to version 2.17.0) is due to improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). It allows stored XSS attacks, where malicious scripts can be injected and executed in the context of the affected application. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, high privileges, and user interaction, with impacts on confidentiality, integrity, and availability.

An attacker with high privileges and the ability to trick a user into interacting with malicious content could exploit this vulnerability to execute arbitrary scripts in the context of the affected application. This could lead to partial compromise of confidentiality, integrity, and availability of the system or user data.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting high-privilege user access and exercising caution with user-generated content.