This vulnerability in NotFound Social Links is due to improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting) and CWE-352 (Cross-Site Request Forgery). It allows stored XSS attacks, where malicious scripts can be injected and persistently stored, potentially executed in the context of other users. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with partial impact on confidentiality, integrity, and availability. The affected versions include all versions through 1.0.11.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially resulting in partial disclosure of information, modification of data, and disruption of service. The attack requires user interaction and privileges, limiting the scope but still posing a moderate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates.