CVE-2024-2580 is a CWE-79 stored cross-site scripting vulnerability in FunnelKit Automation By Autonami (up to version 2.8.2). It results from improper input neutralization during web page generation, enabling an attacker with low privileges and requiring user interaction to inject and execute malicious scripts. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as reflected in its CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No patch or official remediation level has been disclosed by the vendor, and it is not a cloud service.

Successful exploitation could allow an attacker with low privileges to execute stored malicious scripts in the context of users who view the affected pages, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction, and the overall severity is medium. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with input handling and consider applying any available temporary mitigations recommended by the vendor. Monitor for updates from FunnelKit regarding patches or workarounds.