This vulnerability (CVE-2024-31104) in GetResponse for WordPress is a stored cross-site scripting (CWE-79) issue caused by improper input sanitization during web page generation. It affects all versions up to 5.5.33 of the plugin. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, requiring privileges and user interaction, with impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor or in the advisory data. The plugin is not a cloud service, so remediation depends on updating the plugin once a fix is available.

Successful exploitation could allow an attacker with privileges to inject malicious scripts that execute in the browsers of users viewing the affected content, potentially leading to data disclosure, modification, or disruption of service. The vulnerability impacts confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with plugin usage and limit privileges to trusted users. Monitor for updates from GetResponse and apply any official patches promptly once available.