This vulnerability, identified as CWE-79, is a cross-site scripting (XSS) flaw in pixfort Core versions before 4.3.3. It arises from improper neutralization of input during web page generation, which could allow an attacker with low privileges to inject and execute malicious scripts in the context of a user's browser session. The CVSS 3.1 base score is 5.4, indicating medium severity, with attack vector network, low attack complexity, requiring privileges, user interaction, and partial impact to confidentiality and integrity but no impact to availability.

Successful exploitation could allow an attacker with limited privileges to execute arbitrary scripts in the context of other users' browsers, potentially leading to partial disclosure or modification of information accessible to the user. There is no indication of availability impact or known active exploitation in the wild.

No explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is confirmed, users should exercise caution with untrusted input and consider applying any official updates once available.