The WP Marketing Robot WooCommerce Google Feed Manager plugin contains a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2024-29112. This vulnerability allows improper neutralization of input during web page generation, enabling an attacker with high privileges to inject malicious scripts that execute in the context of other users. The affected versions include all versions up to 2.2.0. The CVSS 3.1 base score is 5.9, reflecting network attack vector, low attack complexity, high privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published, and no known exploits are currently reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute stored malicious scripts in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and high privileges, which limits the attack scope. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit administrative access to trusted personnel and be cautious with input handling. Monitor vendor communications for updates on patches or official mitigations.