The RadiusTheme Metro product contains a DOM-based Cross-site Scripting vulnerability due to improper input neutralization during web page generation. This vulnerability affects all versions up to 2.13. An attacker could exploit this issue to execute arbitrary scripts in the victim's browser, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope change with low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure, manipulation of web content, or disruption of service. The CVSS score of 7.1 indicates a high impact on confidentiality, integrity, and availability, but no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor RadiusTheme's official channels for updates. In the meantime, consider applying web application firewall (WAF) rules to detect and block suspicious input patterns related to DOM-based XSS if feasible.