This vulnerability in the List category posts plugin by Fernando Briano involves improper neutralization of input during web page generation, resulting in a DOM-based XSS flaw. It affects versions up to and including 0.93.1. The CVSS score is 5.9 (medium), with attack vector network, low attack complexity, high privileges required, and user interaction needed. The vulnerability can cause partial compromise of confidentiality, integrity, and availability. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Exploitation of this vulnerability could allow an attacker with high privileges and requiring user interaction to execute malicious scripts in the context of the affected web page. This may lead to limited disclosure of information, modification of data, or disruption of service within the scope of the affected application. However, the impact is limited by the requirement for high privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and avoid interacting with untrusted content in the affected plugin. Monitor vendor channels for updates or patches addressing this vulnerability.