The vulnerability identified as CVE-2024-22306 in the Hometory Mang Board WP plugin is a stored cross-site scripting (CWE-79) issue. It arises from improper neutralization of input during web page generation, which can allow an attacker to inject malicious scripts that are stored and executed in the context of other users. The affected versions include all versions up to 1.7.7. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, high privileges, user interaction, and impacts confidentiality, integrity, and availability to a limited degree. No patch or official fix has been documented in the provided information.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the browsers of other users, potentially leading to limited confidentiality, integrity, and availability impacts. This could result in unauthorized actions performed on behalf of users or disclosure of sensitive information within the affected application context. However, exploitation requires user interaction and high privileges, which limits the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting high-privilege user access and exercising caution with user-generated content. Monitor vendor channels for updates regarding patches or official mitigations.