This vulnerability (CVE-2024-24865) in the Noah Kagan Scroll Triggered Box plugin is classified as CWE-79, indicating improper neutralization of input leading to stored cross-site scripting. It affects versions through 2.3 and allows an attacker with low privileges to inject malicious scripts that execute when a user interacts with the affected web page. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low to low respectively, resulting in an overall medium severity score of 6.5. No official fix or patch has been published by the vendor, and no known active exploitation has been reported.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure, modification, or denial of service. However, exploitation requires low privileges and user interaction, which somewhat limits the attack scope. The vulnerability impacts confidentiality, integrity, and availability to a low degree, consistent with the CVSS score of 6.5 (medium severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates. Until a patch is available, consider applying input validation or output encoding workarounds if feasible, and restrict privileges to minimize risk. No vendor advisory states that no action is required or that the issue is already mitigated.