CVE-2024-25597 is a stored cross-site scripting vulnerability (CWE-79) affecting Etoile Web Design Ultimate Reviews versions up to 3.2.8. The issue arises from improper input sanitization during web page generation, enabling attackers to inject and store malicious scripts that execute when other users view the affected content. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts to confidentiality, integrity, and availability at a low level. No patch or official fix has been disclosed by the vendor, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this stored XSS vulnerability could allow attackers to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, session hijacking, or other impacts affecting confidentiality, integrity, and availability. The CVSS vector indicates a low complexity attack that requires user interaction but no privileges. The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a patch is released, consider applying temporary mitigations such as input validation and output encoding at the application level if feasible. Avoid exposing the vulnerable functionality to untrusted users where possible.