This vulnerability (CVE-2024-29098) in WP Calameo involves CWE-79: improper neutralization of input during web page generation, resulting in stored cross-site scripting. An attacker with low privileges and requiring user interaction can exploit this to execute arbitrary scripts in the context of affected users. The vulnerability affects all versions through 2.1.7. No vendor advisory or patch information is currently available, and no known active exploitation has been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users who view the affected pages, potentially leading to information disclosure, session hijacking, or other impacts typical of stored XSS vulnerabilities. The CVSS vector indicates low attack complexity, requiring user interaction and limited privileges, with partial impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting user input that can be rendered in web pages or applying web application firewall (WAF) rules to detect and block XSS payloads related to WP Calameo. Monitor official Calameo channels for updates and patches.