This vulnerability in welovemedia FFmate (up to version 2.0.15) involves a cross-site scripting flaw in the AppJsonTreeView.vue file of the Webhook Handler component. The flaw allows remote attackers to inject scripts that may execute in the context of the affected application. The vulnerability requires low attack complexity and no privileges but does require user interaction. The vendor has not issued a patch or advisory, and the exploit has been publicly disclosed.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the vulnerable component. This can lead to session hijacking, defacement, or other client-side attacks. However, the vulnerability requires user interaction and limited privileges, which reduces the overall impact severity to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying input validation or sanitization workarounds if possible, or restrict access to the vulnerable component until an official fix is released.