CVE-2024-29814 is a stored cross-site scripting vulnerability (CWE-79) affecting the CurrencyRate.Today Exchange Rates Widget through version 1.4.0. The vulnerability is caused by improper input neutralization during web page generation, which allows attackers to inject and store malicious scripts that execute in the context of users viewing the widget. The CVSS 3.1 score is 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality, integrity, and availability. No vendor-provided patch or official remediation level is currently available. The product is not a cloud service, so remediation depends on vendor updates or user-side mitigations.

Successful exploitation of this vulnerability can lead to stored XSS attacks, potentially allowing attackers to execute arbitrary scripts in the context of users interacting with the Exchange Rates Widget. This can result in partial loss of confidentiality, integrity, and availability of affected systems or user sessions. The CVSS vector indicates that an attacker with low privileges and requiring user interaction can exploit this remotely over the network. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor for vendor updates. As a temporary mitigation, consider sanitizing or filtering inputs before they are processed by the widget if possible. Avoid using untrusted data in the widget until a fix is released. No vendor advisory states that no action is required or that the issue is already mitigated.