CVE-2024-0678 is a stored cross-site scripting vulnerability in the Order Delivery Date for WP e-Commerce plugin for WordPress, affecting all versions up to and including 1.2. The vulnerability arises from improper neutralization of input in the 'available-days-tf' parameter, enabling unauthenticated attackers to inject arbitrary web scripts that execute in the context of users viewing the injected pages. This plugin version is discontinued and was hosted in the WordPress repository. The WooCommerce version of the similarly named plugin is not impacted. No known exploits are reported in the wild, and no patch or remediation is currently provided by the vendor.

Successful exploitation can lead to execution of arbitrary scripts in the context of users accessing the affected pages, potentially resulting in information disclosure or session hijacking. The vulnerability is exploitable remotely without authentication. However, the plugin is discontinued, which may limit exposure. No known active exploitation has been reported.

No official patch or fix is currently available for this vulnerability. Since the affected plugin version is discontinued, the recommended mitigation is to uninstall or replace the vulnerable plugin with a maintained alternative. Users should avoid using the affected versions and verify that they are not running the vulnerable plugin. The WooCommerce version of the plugin is not affected and can be used as an alternative.