CVE-2024-29813 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in the Funnel Builder by CartFlows plugin. It allows stored cross-site scripting (XSS) attacks by failing to properly sanitize user input before rendering it in web pages. The vulnerability affects versions up to 2.0.1 and requires an attacker to have high privileges and user interaction to exploit. The CVSS 3.1 base score is 5.9, reflecting network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability. No patch or official fix has been published yet.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to data disclosure, modification, or disruption of service. The impact is rated medium based on the CVSS score and the requirement for high privileges and user interaction. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to the affected plugin to trusted users only and monitor for suspicious activity. Avoid exposing the vulnerable functionality to untrusted users. Follow vendor communications for updates on patches or official mitigations.