This vulnerability (CVE-2024-32510) is classified as CWE-79, indicating improper neutralization of input during web page generation, resulting in reflected Cross-site Scripting (XSS) in the Loopus WP Cost Estimation & Payment Forms Builder plugin. The affected versions include all versions up to 10.1.75. The CVSS v3.1 base score is 7.1 (high), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor, and it is not a cloud service. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial compromise of confidentiality, integrity, and availability of the system or user data. The CVSS vector indicates that user interaction is required and the attack can be performed remotely without privileges. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, consider limiting exposure by restricting access or disabling the affected plugin if feasible.