This vulnerability (CVE-2024-22150) in PWR Plugins' Portfolio & Image Gallery for WordPress | PowerFolio is a stored cross-site scripting (CWE-79) flaw caused by improper input neutralization during web page generation. It allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can affect confidentiality, integrity, and availability to a limited extent. The affected versions include all versions up to 3.1. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and partial impact on confidentiality, integrity, and availability. No official patch or vendor remediation level has been published as of the data provided.

Successful exploitation can lead to stored cross-site scripting attacks, potentially allowing attackers to execute arbitrary scripts in the context of users visiting affected pages. This can result in partial compromise of confidentiality, integrity, and availability of the affected WordPress site. However, exploitation requires user interaction and low privileges, limiting the scope of impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting the use of the affected plugin or restricting user privileges to reduce risk. Monitor for updates from PWR Plugins or WordPress plugin repositories for any released patches or temporary mitigations.