CVE-2024-23501 is a stored cross-site scripting vulnerability (CWE-79) in the Shopfiles Ltd Ebook Store product, affecting versions up to 5.788. The vulnerability results from improper neutralization of input during web page generation, which can allow an attacker to inject and store malicious scripts that execute in the context of other users' browsers. The CVSS 3.1 base score is 5.9, reflecting network attack vector, low attack complexity, required high privileges, required user interaction, and impacts on confidentiality, integrity, and availability at a low level. No patch or official remediation guidance is currently available from the vendor. The product is not a cloud service, so remediation depends on vendor or user action.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the browsers of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The attack requires user interaction and privileges, reducing the likelihood of widespread exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with privileged accounts and monitor for suspicious activity related to script injection. No vendor advisory or patch links are currently provided.