This vulnerability exists because ElkArte Forum 2.0 Beta 1 does not properly encode or sanitize user input in the cust_blurb and cust_locate profile fields. The injected JavaScript payload is stored persistently and executed when an administrator views the affected user profile. The vulnerability is a classic stored XSS (CWE-79) that can compromise administrator sessions and elevate attacker privileges. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

An attacker with a registered user account can inject malicious JavaScript that executes in the context of an administrator's browser session. This can lead to session hijacking or privilege escalation, allowing the attacker to perform administrative actions or access sensitive data. The CVSS 3.1 base score is 5.4 (medium severity), reflecting the network attack vector, low attack complexity, required privileges of a registered user, and user interaction needed (administrator viewing the profile).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should be cautious when viewing user profiles, especially those of untrusted users. Consider restricting profile field inputs or applying manual input sanitization as a temporary mitigation.