The WP-Cufon plugin for WordPress, developed by Tobias Battenberg, contains a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2024-32541. This vulnerability affects all versions up to 1.6.10 and arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that persist and execute in users' browsers. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity with network attack vector and impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor as of the data provided. No known exploits have been observed in the wild.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting the affected site, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability requires user interaction and can be exploited remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP-Cufon plugin if feasible. Additionally, applying web application firewall (WAF) rules to detect and block XSS payloads may help mitigate risk. Monitor official sources for updates and apply patches promptly once available.