This vulnerability (CVE-2024-29929) involves improper input sanitization in WC Lovers WCFM – Frontend Manager for WooCommerce, leading to stored cross-site scripting (CWE-79). It affects all versions through 6.7.8. The vulnerability allows an attacker with high privileges and user interaction to inject malicious scripts that execute in the context of other users, potentially impacting confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, required privileges, and user interaction, with a scope change.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute when other users view affected pages. This may lead to limited confidentiality, integrity, and availability impacts such as session hijacking or unauthorized actions within the affected application. However, the impact is rated medium, reflecting the requirement for privileges and user interaction.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to trusted users only and monitor for suspicious activity related to script injection. Avoid exposing the affected plugin to untrusted users where possible.