CVE-2024-1774 is a stored cross-site scripting vulnerability in the Customily Product Personalizer plugin for WordPress, affecting all versions up to 1.23.3. The issue arises from improper neutralization of user cookie input during web page generation, allowing unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the affected pages. The vulnerability is classified under CWE-79 and has a CVSS v3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact. No vendor advisory or patch is currently available, and the vendor has not been contacted successfully for disclosure.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of users visiting affected pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. There is no reported impact on availability. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no vendor contact or patch is available, users should consider disabling the plugin or restricting its use until a fix is released. Implementing web application firewall (WAF) rules to detect and block suspicious input related to this vulnerability may provide temporary mitigation.