This vulnerability affects LinkStackOrg LinkStack up to version 4.8.6 in the editPage function within app/Http/Controllers/UserController.php. An attacker can manipulate the pageDescription parameter to inject malicious scripts, resulting in cross-site scripting. The attack vector is remote and requires low privileges with partial user interaction. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No official patch or remediation has been released by the vendor as of the published date.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability requires low privileges and some user interaction but does not require complex attack conditions. No known exploits are reported in the wild beyond the publicly available proof of concept.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not reacted or released a fix, users should consider applying temporary mitigations such as input validation or output encoding on the pageDescription parameter if possible. Monitor official vendor channels for updates and patches.