CVE-2024-2194 is a stored cross-site scripting vulnerability in the WP Statistics plugin by veronalabs, affecting all versions up to 14.5. The flaw is due to improper neutralization of input (CWE-79) in the URL search parameter, enabling unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the injected pages. The vulnerability has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with scope change. No patch or remediation details are currently available.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in users' browsers. This can result in the compromise of user confidentiality and integrity within the affected application context. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin or applying manual input sanitization and output escaping if feasible. Monitor vendor channels for updates and apply patches promptly once released.