The vulnerability CVE-2024-30553 in the WP Twitter Mega Fan Box Widget by Joby Joseph is a stored cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. It affects all versions up to 1.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with low confidentiality, integrity, and availability impacts. No patch or official remediation level has been provided yet, and it is not a cloud service. No known active exploitation has been reported.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute arbitrary scripts in the context of the affected web application. This may lead to partial compromise of confidentiality, integrity, and availability of the affected system. However, the impact is rated medium due to the required privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to high-privilege accounts and monitor for suspicious activity related to this plugin. Avoid installing or using the affected versions if possible.