This vulnerability, identified as CWE-79, is a Cross-Site Scripting (XSS) flaw in FluentCommunity versions up to and including 2.7.5. It arises from improper neutralization of input during web page generation, allowing subscribers to execute arbitrary scripts in the context of other users. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and partial impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Exploitation of this vulnerability could allow an attacker with subscriber-level privileges to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure of information, modification of data, or disruption of service. The scope is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component. However, the impact is limited to partial confidentiality, integrity, and availability loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting subscriber privileges or applying web application firewall (WAF) rules to detect and block XSS attempts. Monitor vendor communications for updates on patches or official mitigations.