The vulnerability CVE-2024-22161 in Harmonic Design HD Quiz is a stored cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. It affects versions up to 1.8.11 and allows an attacker with high privileges to inject malicious scripts that execute in the context of other users. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability to a limited extent.

An attacker with high privileges can exploit this vulnerability to inject malicious scripts that execute in the browsers of other users who view the affected pages. This can lead to limited confidentiality, integrity, and availability impacts such as session hijacking, defacement, or other malicious actions within the context of the vulnerable application. There are no reports of active exploitation in the wild.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, limit high-privilege user access and exercise caution with user-generated content. Avoid exposing the vulnerable plugin to untrusted users where possible.