This vulnerability in merkulove Speaker involves improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). An attacker could inject malicious scripts that are stored and later executed in the context of users viewing the affected web pages. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacting confidentiality, integrity, and availability. The affected versions include all versions up to and including 4.1.13. No vendor advisory or patch information is currently provided.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users of the merkulove Speaker application, potentially leading to partial disclosure of sensitive information, modification of data, or disruption of service. The CVSS vector indicates partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply general best practices for mitigating stored XSS, such as input validation and output encoding where possible, and limit privileges of affected users. Monitor vendor communications for updates.