The don-themes Molla product contains a reflected cross-site scripting vulnerability due to improper input neutralization during web page generation. This affects versions before 1.5.19. The vulnerability allows an attacker to inject malicious scripts that execute when a victim interacts with a crafted URL or input, potentially leading to partial compromise of confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.

Successful exploitation of this vulnerability can result in the execution of arbitrary scripts in the context of the victim's browser, potentially leading to partial disclosure of sensitive information, modification of data, and disruption of availability. The CVSS score reflects these impacts as low confidentiality, integrity, and availability impacts with scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor don-themes communications for updates. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts and avoid exposing vulnerable endpoints to untrusted input.