The vulnerability CVE-2024-29137 in Themefic Tourfic (<= 2.11.7) is an improper input neutralization issue during web page generation, categorized as a cross-site scripting (XSS) flaw. This allows attackers to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor or other authoritative sources.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting affected web pages, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent. The CVSS score of 7.1 indicates a high severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as disabling or restricting the use of the affected plugin, employing web application firewalls with XSS protections, and educating users about the risks of interacting with untrusted content. Monitor official Themefic channels for updates.