This vulnerability in the Envision Page Builder plugin (up to version 0.22) is due to improper neutralization of input during web page generation, leading to a DOM-based XSS issue. An attacker with low privileges and requiring user interaction can exploit this to cause partial confidentiality, integrity, and availability impacts. The vulnerability is network exploitable and affects the security context of the plugin's web pages.

Successful exploitation can lead to limited confidentiality, integrity, and availability impacts within the context of the affected web pages. This may allow attackers to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or other malicious actions constrained by the plugin's privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Users should monitor vendor communications for updates and apply patches once available. Until then, limit exposure by restricting user privileges and avoiding untrusted input where possible.