This vulnerability (CVE-2024-24889) in Geek Code Lab's 'All 404 Pages Redirect to Homepage' plugin allows stored Cross-site Scripting (CWE-79) due to improper input neutralization during web page generation. It affects all versions up to 1.9. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. No official remediation or patch is currently documented.

Successful exploitation could allow an attacker to inject and store malicious scripts that execute in the context of users visiting affected pages, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected plugin or disabling it if feasible. Monitor official Geek Code Lab communications for updates. Avoid relying on generic mitigations as the vendor has not provided specific guidance.