This vulnerability in xuxueli xxl-job up to versions 3.4.2 and 3.5.0 involves cross-site scripting via manipulation of the 'name' or 'author' parameters in the Task Management Interface component (JobInfoController.java). The flaw allows remote attackers to inject scripts that could execute in the context of the application user interface. The vendor was notified but has not provided a fix or response. Public exploit details have been disclosed, but no known active exploitation is reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the vulnerability requires user interaction (UI:P) and limited privileges (PR:L), reducing the overall risk. There is no indication of server-side compromise or data breach from this vulnerability alone.

No official patch or remediation has been provided by the vendor. Users should apply strict input validation and output encoding on the 'name' and 'author' parameters to mitigate XSS risks. Monitoring for updates from the vendor is recommended. Since the vendor has not responded, consider implementing web application firewalls or other protective controls to detect and block malicious payloads targeting these parameters.