This vulnerability (CVE-2024-30437) involves improper neutralization of input in the WPPOOL Webinar and Video Conference with Jitsi Meet plugin, leading to stored cross-site scripting (CWE-79). It affects versions up to 2.6.3. An attacker could inject malicious scripts that persist on the server and execute in the context of other users' browsers, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality, integrity, and availability. No patch or official fix has been disclosed yet.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users' browsers interacting with the vulnerable plugin, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, no known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting privileges of users who can submit input to the plugin and apply web application firewall (WAF) rules to detect and block XSS payloads related to this vulnerability. Monitor vendor channels for updates and apply patches promptly once available.