This vulnerability, identified as CWE-79, involves improper neutralization of input during web page generation in the Popup by Supsystic plugin. It allows unauthenticated attackers to perform cross-site scripting (XSS) attacks, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in partial disclosure of information, modification of data, and disruption of service availability. The vulnerability requires low privileges and user interaction but can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying workarounds such as disabling the vulnerable plugin or restricting access to affected functionality. Monitor vendor channels for updates.