This vulnerability, identified as CWE-79, affects ThemeGrill SmartSMTP versions <= 1.2.0. It allows unauthenticated attackers to perform cross-site scripting (XSS) attacks by injecting malicious input that is not properly sanitized during web page generation. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vulnerability is published but lacks an official remediation or patch at this time.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in partial disclosure of sensitive information, modification of data, or disruption of service. The vulnerability is exploitable remotely without authentication, increasing its risk. However, no active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying workarounds if available or restrict access to the affected application to trusted users. Monitor vendor channels for updates.