The vulnerability identified as CVE-2024-30431 in the Hometory Mang Board WP plugin is a reflected cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. It affects versions up to 1.8.0 and allows attackers to inject malicious scripts that are reflected in the web response, potentially leading to user session compromise or other impacts. The CVSS 3.1 base score is 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated low to low to low respectively. No patch or official remediation has been disclosed by the vendor.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, session hijacking, or other impacts on the confidentiality, integrity, and availability of the application and its users. The CVSS score of 7.1 reflects a high severity level due to the network attack vector and the potential for user interaction to trigger the exploit. However, there are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as input validation and output encoding on affected parameters if possible. Monitoring for updates from the vendor Hometory is recommended to apply any forthcoming official patches promptly.