This vulnerability is a stored XSS (CWE-79) in the TPVEnlanube Cloud Web application, specifically in the 'vendor_store_name' parameter of the administrative endpoint for adding stores. Successful exploitation requires authentication and allows injection of malicious code that executes in users' browsers without their consent. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond authentication, user interaction required, and limited impact on confidentiality and integrity but some impact on system integrity.

An authenticated attacker can inject malicious scripts into the application that will be stored and later executed in the browsers of users who view the affected page. This can lead to unauthorized actions performed on behalf of users, theft of session tokens, or other malicious activities executed in the context of the victim's browser session. The impact is limited to users who interact with the vulnerable functionality and requires attacker authentication.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected administrative endpoint to trusted users only and consider applying input validation or output encoding controls to mitigate XSS risks.