This vulnerability (CVE-2024-29925) in wpWax Post Grid, Slider & Carousel Ultimate plugin allows stored cross-site scripting (CWE-79) due to improper input neutralization during web page generation. It affects versions up to 1.6.6. An attacker with low privileges can inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L with a score of 6.5. No official patch or remediation guidance is currently available from the vendor, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute stored malicious scripts in the context of other users, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium based on the CVSS score of 6.5. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting privileges of users who can submit content and apply web application firewall (WAF) rules to detect and block XSS payloads. Monitor vendor channels for updates and apply patches promptly once available.