This vulnerability involves multiple authenticated XSS issues in the XssHttpServletRequestWrapper class of shopizer v3.2.5. The flaw allows authenticated attackers to inject malicious scripts or HTML via the getInputStream() or getReader() methods, which process input streams and readers. The vulnerability is published but lacks CVSS scoring and vendor remediation details. No patch links or advisories are currently provided. The vulnerability requires authentication, limiting exploitation scope but still posing significant risk for session hijacking or other script-based attacks.

Successful exploitation allows authenticated attackers to execute arbitrary web scripts or HTML within the context of the vulnerable application. This can lead to session hijacking, defacement, or other malicious actions that leverage the victim's browser privileges. Since the vulnerability requires authentication, the attack surface is limited to users with valid credentials. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted authenticated users only and monitor for suspicious activity related to input handling in the affected functions. Avoid exposing sensitive functionality to untrusted users. Follow vendor channels for updates on patches or official mitigations.