The vulnerability CVE-2024-29771 in SoftLab's Dracula Dark Mode WordPress plugin is a stored cross-site scripting issue (CWE-79) caused by improper input neutralization during web page generation. This allows attackers with low privileges to inject malicious scripts that execute when other users view the affected content. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability at a low level. The affected versions include all up to 1.0.8. No vendor advisory or patch is currently available, and the plugin is not a cloud service.

Successful exploitation could allow an attacker with low privileges to inject and execute malicious scripts in the context of the affected WordPress site, potentially leading to partial confidentiality, integrity, and availability impacts. This could affect users who interact with the malicious content, but the overall severity is medium given the required user interaction and privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting plugin usage or applying temporary mitigations such as input sanitization or disabling the plugin if feasible. Monitor official SoftLab communications for updates on patches or mitigations.