This vulnerability (CVE-2024-29801) affects the Fullscreen Galleria product by Petri Damstén, allowing stored cross-site scripting due to improper input sanitization during web page generation. The flaw permits an attacker with low privileges and requiring user interaction to execute arbitrary scripts, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, and user interaction needed, with a scope change and partial impact on confidentiality, integrity, and availability. The affected versions include all versions up to 1.6.11. No patch or official fix has been published yet.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to data theft, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The impact is rated medium based on the CVSS score of 6.5. There are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor communications for updates regarding an official patch or workaround.