The RadiusTheme Metro product contains a DOM-based XSS vulnerability due to improper input neutralization during web page generation. This vulnerability affects all versions up to 2.13. An attacker could exploit this to execute arbitrary scripts in the victim's browser, potentially leading to partial compromise of user data and application availability. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability at a low level. No patch or vendor advisory is currently provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to limited disclosure of confidential information, modification of data, and disruption of application availability. The attack requires user interaction and can be performed remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor RadiusTheme communications for updates and apply patches promptly once released.