The vulnerability CVE-2024-30506 in Vsourz Digital All In One Redirection plugin is a stored Cross-site Scripting (CWE-79) issue caused by improper input sanitization during web page generation. It affects all versions up to 2.2.0. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability can lead to a complete scope impact with low confidentiality, integrity, and availability impacts. No official patch or remediation guidance has been provided by the vendor or in the advisory.

Successful exploitation allows an attacker to inject and store malicious scripts that execute in the context of users' browsers visiting the affected site. This can lead to unauthorized actions such as session hijacking, defacement, or other malicious activities impacting confidentiality, integrity, and availability at a low level. The scope is changed, meaning the impact extends beyond the vulnerable component to other components or users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying temporary mitigations such as disabling or restricting the plugin usage, implementing web application firewall (WAF) rules to detect and block XSS payloads, and educating users about the risk of interacting with untrusted content. Monitor vendor channels for updates regarding an official patch.